ramnit | 681c48072a1d1fda5e7b57e7442faf65313a884998a537dac888d31dd76106eb

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7v20210408
submitted
11-05-2021 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

681c48072a1d1fda5e7b57e7442faf65313a884998a537dac888d31dd76106eb.dll
Size

450KB
MD5

dd1b9b35147cd5810a94c1a0fa07b77c
SHA1

6c3914d682172b5bfa0fae5804a7f56d5b5b60f6
SHA256

681c48072a1d1fda5e7b57e7442faf65313a884998a537dac888d31dd76106eb
SHA512

cdb6654feec55cbc4dbc9cb6a70d3f8ca59b1f63fa8bc381e643b14942e2e5891d7674fe6ca82bfe5f3a225ab48383cc3f8bd71fcdf44b32e76928dd5c3b5daf

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 6 IoCs

Processes:

rundll32Srv.exerundll32SrvSrv.exerundll32SrvSrvSrv.exeDesktopLayer.exeDesktopLayerSrv.exeDesktopLayerSrvSrv.exe

pid process

1836 rundll32Srv.exe
1348 rundll32SrvSrv.exe
1940 rundll32SrvSrvSrv.exe
1088 DesktopLayer.exe
1792 DesktopLayerSrv.exe
1776 DesktopLayerSrvSrv.exe

pid	process
1836	rundll32Srv.exe
1348	rundll32SrvSrv.exe
1940	rundll32SrvSrvSrv.exe
1088	DesktopLayer.exe
1792	DesktopLayerSrv.exe
1776	DesktopLayerSrvSrv.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\rundll32Srv.exe	upx
C:\Windows\SysWOW64\rundll32Srv.exe	upx
\Windows\SysWOW64\rundll32SrvSrv.exe	upx
C:\Windows\SysWOW64\rundll32Srv.exe	upx
C:\Windows\SysWOW64\rundll32SrvSrv.exe	upx
\Windows\SysWOW64\rundll32SrvSrvSrv.exe	upx
C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe	upx
C:\Windows\SysWOW64\rundll32SrvSrv.exe	upx
C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	upx
behavioral1/memory/1940-108-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1348-106-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1836-104-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Loads dropped DLL 6 IoCs

Processes:

rundll32.exerundll32Srv.exerundll32SrvSrv.exeDesktopLayer.exeDesktopLayerSrv.exe

pid process

1628 rundll32.exe
1836 rundll32Srv.exe
1348 rundll32SrvSrv.exe
1836 rundll32Srv.exe
1088 DesktopLayer.exe
1792 DesktopLayerSrv.exe

pid	process
1628	rundll32.exe
1836	rundll32Srv.exe
1348	rundll32SrvSrv.exe
1836	rundll32Srv.exe
1088	DesktopLayer.exe
1792	DesktopLayerSrv.exe

Drops file in System32 directory 3 IoCs

Processes:

rundll32.exerundll32Srv.exerundll32SrvSrv.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32SrvSrv.exe	rundll32Srv.exe
File created	C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe	rundll32SrvSrv.exe

Drops file in Program Files directory 13 IoCs

Processes:

rundll32SrvSrv.exerundll32SrvSrvSrv.exeDesktopLayerSrv.exeDesktopLayerSrvSrv.exerundll32Srv.exeDesktopLayer.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px9618.tmp	rundll32SrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px9637.tmp	rundll32SrvSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32SrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px97EC.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	rundll32SrvSrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe	DesktopLayerSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px982A.tmp	DesktopLayerSrvSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px94E0.tmp	rundll32Srv.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 1628 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2008	1628	WerFault.exe	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20C27E31-B2CB-11EB-AFB7-728C2BD580E2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20C9A251-B2CB-11EB-AFB7-728C2BD580E2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20C2A541-B2CB-11EB-AFB7-728C2BD580E2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

rundll32SrvSrv.exerundll32SrvSrvSrv.exeDesktopLayer.exeWerFault.exeDesktopLayerSrv.exeDesktopLayerSrvSrv.exe

pid	process
1348	rundll32SrvSrv.exe
1940	rundll32SrvSrvSrv.exe
1940	rundll32SrvSrvSrv.exe
1348	rundll32SrvSrv.exe
1348	rundll32SrvSrv.exe
1348	rundll32SrvSrv.exe
1940	rundll32SrvSrvSrv.exe
1940	rundll32SrvSrvSrv.exe
1088	DesktopLayer.exe
1088	DesktopLayer.exe
2008	WerFault.exe
2008	WerFault.exe
2008	WerFault.exe
2008	WerFault.exe
2008	WerFault.exe
1088	DesktopLayer.exe
1088	DesktopLayer.exe
1792	DesktopLayerSrv.exe
1792	DesktopLayerSrv.exe
1792	DesktopLayerSrv.exe
1792	DesktopLayerSrv.exe
1776	DesktopLayerSrvSrv.exe
1776	DesktopLayerSrvSrv.exe
1776	DesktopLayerSrvSrv.exe
1776	DesktopLayerSrvSrv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2008 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2008 WerFault.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid process

1744 iexplore.exe
1504 iexplore.exe
1716 iexplore.exe
1268 iexplore.exe
1656 iexplore.exe

pid	process
2008	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2008	WerFault.exe

pid	process
1744	iexplore.exe
1504	iexplore.exe
1716	iexplore.exe
1268	iexplore.exe
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1656	iexplore.exe
1656	iexplore.exe
1744	iexplore.exe
1268	iexplore.exe
1268	iexplore.exe
1744	iexplore.exe
1504	iexplore.exe
1504	iexplore.exe
1716	iexplore.exe
1716	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
780	IEXPLORE.EXE
780	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1168	IEXPLORE.EXE
1168	IEXPLORE.EXE
468	IEXPLORE.EXE
468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32Srv.exerundll32SrvSrv.exerundll32SrvSrvSrv.exeDesktopLayer.exeDesktopLayerSrv.exeDesktopLayerSrvSrv.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 756 wrote to memory of 1628	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1628	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1628	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1628	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1628	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1628	756	rundll32.exe	rundll32.exe
PID 756 wrote to memory of 1628	756	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1836	1628	rundll32.exe	rundll32Srv.exe
PID 1628 wrote to memory of 1836	1628	rundll32.exe	rundll32Srv.exe
PID 1628 wrote to memory of 1836	1628	rundll32.exe	rundll32Srv.exe
PID 1628 wrote to memory of 1836	1628	rundll32.exe	rundll32Srv.exe
PID 1836 wrote to memory of 1348	1836	rundll32Srv.exe	rundll32SrvSrv.exe
PID 1836 wrote to memory of 1348	1836	rundll32Srv.exe	rundll32SrvSrv.exe
PID 1836 wrote to memory of 1348	1836	rundll32Srv.exe	rundll32SrvSrv.exe
PID 1836 wrote to memory of 1348	1836	rundll32Srv.exe	rundll32SrvSrv.exe
PID 1628 wrote to memory of 2008	1628	rundll32.exe	WerFault.exe
PID 1628 wrote to memory of 2008	1628	rundll32.exe	WerFault.exe
PID 1628 wrote to memory of 2008	1628	rundll32.exe	WerFault.exe
PID 1628 wrote to memory of 2008	1628	rundll32.exe	WerFault.exe
PID 1348 wrote to memory of 1940	1348	rundll32SrvSrv.exe	rundll32SrvSrvSrv.exe
PID 1348 wrote to memory of 1940	1348	rundll32SrvSrv.exe	rundll32SrvSrvSrv.exe
PID 1348 wrote to memory of 1940	1348	rundll32SrvSrv.exe	rundll32SrvSrvSrv.exe
PID 1348 wrote to memory of 1940	1348	rundll32SrvSrv.exe	rundll32SrvSrvSrv.exe
PID 1836 wrote to memory of 1088	1836	rundll32Srv.exe	DesktopLayer.exe
PID 1836 wrote to memory of 1088	1836	rundll32Srv.exe	DesktopLayer.exe
PID 1836 wrote to memory of 1088	1836	rundll32Srv.exe	DesktopLayer.exe
PID 1836 wrote to memory of 1088	1836	rundll32Srv.exe	DesktopLayer.exe
PID 1940 wrote to memory of 1504	1940	rundll32SrvSrvSrv.exe	iexplore.exe
PID 1940 wrote to memory of 1504	1940	rundll32SrvSrvSrv.exe	iexplore.exe
PID 1940 wrote to memory of 1504	1940	rundll32SrvSrvSrv.exe	iexplore.exe
PID 1940 wrote to memory of 1504	1940	rundll32SrvSrvSrv.exe	iexplore.exe
PID 1348 wrote to memory of 1656	1348	rundll32SrvSrv.exe	iexplore.exe
PID 1348 wrote to memory of 1656	1348	rundll32SrvSrv.exe	iexplore.exe
PID 1348 wrote to memory of 1656	1348	rundll32SrvSrv.exe	iexplore.exe
PID 1348 wrote to memory of 1656	1348	rundll32SrvSrv.exe	iexplore.exe
PID 1088 wrote to memory of 1792	1088	DesktopLayer.exe	DesktopLayerSrv.exe
PID 1088 wrote to memory of 1792	1088	DesktopLayer.exe	DesktopLayerSrv.exe
PID 1088 wrote to memory of 1792	1088	DesktopLayer.exe	DesktopLayerSrv.exe
PID 1088 wrote to memory of 1792	1088	DesktopLayer.exe	DesktopLayerSrv.exe
PID 1088 wrote to memory of 1744	1088	DesktopLayer.exe	iexplore.exe
PID 1088 wrote to memory of 1744	1088	DesktopLayer.exe	iexplore.exe
PID 1088 wrote to memory of 1744	1088	DesktopLayer.exe	iexplore.exe
PID 1088 wrote to memory of 1744	1088	DesktopLayer.exe	iexplore.exe
PID 1792 wrote to memory of 1776	1792	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1792 wrote to memory of 1776	1792	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1792 wrote to memory of 1776	1792	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1792 wrote to memory of 1776	1792	DesktopLayerSrv.exe	DesktopLayerSrvSrv.exe
PID 1792 wrote to memory of 1716	1792	DesktopLayerSrv.exe	iexplore.exe
PID 1792 wrote to memory of 1716	1792	DesktopLayerSrv.exe	iexplore.exe
PID 1792 wrote to memory of 1716	1792	DesktopLayerSrv.exe	iexplore.exe
PID 1792 wrote to memory of 1716	1792	DesktopLayerSrv.exe	iexplore.exe
PID 1776 wrote to memory of 1268	1776	DesktopLayerSrvSrv.exe	iexplore.exe
PID 1776 wrote to memory of 1268	1776	DesktopLayerSrvSrv.exe	iexplore.exe
PID 1776 wrote to memory of 1268	1776	DesktopLayerSrvSrv.exe	iexplore.exe
PID 1776 wrote to memory of 1268	1776	DesktopLayerSrvSrv.exe	iexplore.exe
PID 1656 wrote to memory of 1168	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 1168	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 1168	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 1168	1656	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 468	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 468	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 468	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 468	1744	iexplore.exe	IEXPLORE.EXE
PID 1268 wrote to memory of 1048	1268	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\681c48072a1d1fda5e7b57e7442faf65313a884998a537dac888d31dd76106eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\681c48072a1d1fda5e7b57e7442faf65313a884998a537dac888d31dd76106eb.dll,#1
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\rundll32Srv.exe
C:\Windows\SysWOW64\rundll32Srv.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\rundll32SrvSrv.exe
C:\Windows\SysWOW64\rundll32SrvSrv.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe
C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1504

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:2
7⤵
- Suspicious use of SetWindowsHookEx
PID:1836

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
6⤵
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:468

C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792

C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
"C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
7⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:2
8⤵
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
7⤵
- Suspicious use of SetWindowsHookEx
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 228
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{209C6831-B2CB-11EB-AFB7-728C2BD580E2}.dat
MD5
2a40467e1a366c41a0a7956a7bb56930

SHA1
b3ce369bcee0e926b3046bed46acba11b6f91bce

SHA256
6fa83ba8147e423eb88e27bafc9c2e2cfef982393dc9cd3113d7907d084d57ce

SHA512
837b4192114aa92d6b0401bc7065fb10cc26400cb65accaf649e66266434c0a5ad7e3827758e381b04ec5565388b2c3a07e7badb60d2e110b170e477f4365365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{209C6831-B2CB-11EB-AFB7-728C2BD580E2}.dat
MD5
d88a6e962515405073ab22b31ab71b1a

SHA1
5e5e9b3c8c0d8640988382ca23c68918d04525ff

SHA256
7563e6d0a65cee6c3cfc15b1df4bd21123464b93e75fd660e18c78dbbadd79a7

SHA512
988a430aa248d67e1afa6f0a16ecdb6ce4d44dcccf2fb56fc9e445a518b5d41a7ea487a2fe10003567d41bce5b991049ce80cadb3456ab8ea17da28b68a506e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{20C2A541-B2CB-11EB-AFB7-728C2BD580E2}.dat
MD5
c41e71b8d0e6459dbacd098fc40d9d1e

SHA1
7008837a87321cb18c088dc90ad324a4bb3026fb

SHA256
89034b20942efd50a30f28496dfce50a4e0875e924e98d5b369544eece0dbbdb

SHA512
b18c80924a7ee8c388615580df05e0335b3a424067ac1599d7ee4716c140b553fa317a39d1b3e6fc83e7ce0f05e5b424afde6929f52ffac81c942194614ca1c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EQNJY31I.txt
MD5
83341422147f74881e6727d41e6f5cde

SHA1
1df5b484812d8b5ccb0fea2d24a4fd3523b8557b

SHA256
f93456d76c6be5ca3d46f52d4556b527196b0bc41596deeb7bbfbfe9898bfa7e

SHA512
e8bb9f2510fac5098e7644021276b27ed8c4e994f36cc5b69b9f8a97f763d6941c7f30cfed5514f92734bd61e4bb03e5c3ce940c3e24c36ea0c92b214224de88

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Windows\SysWOW64\rundll32SrvSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
\Program Files (x86)\Microsoft\DesktopLayerSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Windows\SysWOW64\rundll32Srv.exe
MD5
395a1a546b4424e3f11cd3ea26066ff9

SHA1
2f18bf153ed75cd9f33f356d1b9b02219c3a1279

SHA256
5dd67a6408d0421a214abba36a7642591cce652f8eac6f71f6d357c154025e6a

SHA512
2a5a398a56f895bffb245b830fd9b3003d887c2a71c6f1e022fd25bcec303cacd691dc744c0121f1d93f1f6e9887da386b3fab096ec0090a607d2d1aa72710a7

Download Submit
\Windows\SysWOW64\rundll32SrvSrv.exe
MD5
f018e9eb66dc53d840ee98c5926f1e2e

SHA1
8e736010173688f982e5713fa8b70c978f17ba42

SHA256
8e9e93a7ae39aa3c6e17a11d567cf52e6190b726d76e6f60b57e9db99ee58bb6

SHA512
30b1fb67767eb5b15bd9d45091d9f184811d4934faeed47b672315d8c8d05b9dc031a6a02addb4b71de1c6b286cc62ef61db2f55dfe4df4bd3c584f256ca49a2

Download Submit
\Windows\SysWOW64\rundll32SrvSrvSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/468-118-0x0000000000000000-mapping.dmp

Download
memory/780-121-0x0000000000000000-mapping.dmp

Download
memory/1048-124-0x0000000000610000-0x0000000000612000-memory.dmp

Filesize
8KB

Download
memory/1048-119-0x0000000000000000-mapping.dmp

Download
memory/1088-80-0x0000000000000000-mapping.dmp

Download
memory/1088-90-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1088-109-0x00000000002B0000-0x00000000002ED000-memory.dmp

Filesize
244KB

Download
memory/1168-117-0x0000000000000000-mapping.dmp

Download
memory/1268-103-0x0000000000000000-mapping.dmp

Download
memory/1268-115-0x000007FEFB701000-0x000007FEFB703000-memory.dmp

Filesize
8KB

Download
memory/1348-106-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1348-79-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1348-67-0x0000000000000000-mapping.dmp

Download
memory/1348-105-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/1504-83-0x0000000000000000-mapping.dmp

Download
memory/1628-61-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1628-60-0x0000000000000000-mapping.dmp

Download
memory/1656-85-0x0000000000000000-mapping.dmp

Download
memory/1716-99-0x0000000000000000-mapping.dmp

Download
memory/1744-92-0x0000000000000000-mapping.dmp

Download
memory/1776-94-0x0000000000000000-mapping.dmp

Download
memory/1792-87-0x0000000000000000-mapping.dmp

Download
memory/1792-111-0x0000000000230000-0x000000000025E000-memory.dmp

Filesize
184KB

Download
memory/1836-104-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1836-102-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download
memory/1836-120-0x0000000000000000-mapping.dmp

Download
memory/1836-63-0x0000000000000000-mapping.dmp

Download
memory/1940-73-0x0000000000000000-mapping.dmp

Download
memory/1940-108-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1940-81-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1940-107-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2008-71-0x0000000000000000-mapping.dmp

Download
memory/2008-128-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download