ramnit | e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a

Analysis

max time kernel
89s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
Size

111KB
MD5

0880b69d95271d98fda80ecbd5fd3ee8
SHA1

b0c2e4bbe31bfbc420f109ba228215422d7684b5
SHA256

e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a
SHA512

7cd4fbd2e9c461f0973426419996bb77e0cf22f5fbbdf960da692454cd7bdfd45f079dca3a5e5efa4e74e4cfd47ce322c009f5163194c69cdab883bc3d8be624
SSDEEP

3072:TROzoTq0+RO7IwnYWuSiwMjBik++Zyh8XfB:1kdNwBMZx++ZqeB

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
1536	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe
1084	DesktopLayer.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022de8-133.dat	upx
behavioral2/files/0x0007000000022de8-134.dat	upx
behavioral2/files/0x0004000000022def-136.dat	upx
behavioral2/memory/1536-138-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x0004000000022def-137.dat	upx
behavioral2/memory/4288-139-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/memory/1084-140-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxFB9B.tmp	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxFBAA.tmp	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{64A335A9-41B1-11ED-A0EE-7A46CE8ECE48} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{64B18302-41B1-11ED-A0EE-7A46CE8ECE48} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "959794617"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987710"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371411542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "959794617"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "972607588"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987710"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
1084	DesktopLayer.exe
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
1084	DesktopLayer.exe
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
1084	DesktopLayer.exe
1084	DesktopLayer.exe
1084	DesktopLayer.exe
1084	DesktopLayer.exe
1084	DesktopLayer.exe
1084	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1092	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1092	iexplore.exe
2952	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2952	iexplore.exe
2952	iexplore.exe
1092	iexplore.exe
1092	iexplore.exe
340	IEXPLORE.EXE
340	IEXPLORE.EXE
116	IEXPLORE.EXE
116	IEXPLORE.EXE
340	IEXPLORE.EXE
340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1536	4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe	85
PID 4288 wrote to memory of 1536	4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe	85
PID 4288 wrote to memory of 1536	4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe	85
PID 1536 wrote to memory of 1084	1536	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe	86
PID 1536 wrote to memory of 1084	1536	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe	86
PID 1536 wrote to memory of 1084	1536	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe	86
PID 4288 wrote to memory of 2952	4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe	87
PID 4288 wrote to memory of 2952	4288	e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe	87
PID 1084 wrote to memory of 1092	1084	DesktopLayer.exe	88
PID 1084 wrote to memory of 1092	1084	DesktopLayer.exe	88
PID 2952 wrote to memory of 116	2952	iexplore.exe	89
PID 2952 wrote to memory of 116	2952	iexplore.exe	89
PID 2952 wrote to memory of 116	2952	iexplore.exe	89
PID 1092 wrote to memory of 340	1092	iexplore.exe	90
PID 1092 wrote to memory of 340	1092	iexplore.exe	90
PID 1092 wrote to memory of 340	1092	iexplore.exe	90

C:\Users\Admin\AppData\Local\Temp\e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe
"C:\Users\Admin\AppData\Local\Temp\e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027a.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe
  C:\Users\Admin\AppData\Local\Temp\e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1092 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:340
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
f525b778e6901e8c416e2920e4e3dc0b

SHA1
917ce8ae6d64bdd4dd438488176253022c57a083

SHA256
c9eee793aa4aa79f35d393f9f1d863483aaf4004dea6ac19bda868e92a71f8bd

SHA512
f6f47a4935c09769b8df316e1b459c7b153ed26ac409d4bf2ce62a1635dba4eaf7ce77de5ce83100d6f3ce7aadffed7591fb7cee7ac10a0c081a2d3c613f1ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
e8e4875cf7570c6dddbc37acc8a8d340

SHA1
8938721d56aa0607055bf53f1e6056eb668eb8fa

SHA256
2d496ed5f7685d98ed9d45aa06784947b7d325b4b3281fcc26f674d02b2e7293

SHA512
cff8bfeff23fcbd8da3e1166c8ed54e45a0ff5a5aba4fa3a68a55d857d3f2f4ea7937e561a1a1a2006390ae186cdc7d03dcdaba118bdb38c11fb342683665005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{64A335A9-41B1-11ED-A0EE-7A46CE8ECE48}.dat

Filesize
3KB

MD5
bc7267d8a2442869e2c9c61f36be1666

SHA1
39c358aec4fe49064c199225185987201b0c892d

SHA256
14dd162d41986dfc059b6eb3d272d598313c88c62be277352ec1c9833237a6c2

SHA512
84bcc08c8cb78e35317c7cbfc17bd18caa256088b1c55204ed8fc7d322d4facb951431801cb38bafeb6c8473a75e34b3b6beeef1edd9d15aebe212576cf1c87f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{64B18302-41B1-11ED-A0EE-7A46CE8ECE48}.dat

Filesize
5KB

MD5
fd1fb4f5d9475447984eb67f76f5adf3

SHA1
b524e04c7c0919954edd82fb277288928753a1ce

SHA256
792b554fb36425e2e21b2578dfbd43cc7adcdd1abe2b80f04ddfb3b7bf6e2759

SHA512
9c8f3c20d9d3b64eb12efc10f09f6a54ad7882726729b217c27e42374ff4f18ec8dad53b88e3d909a79fa00c2ec818e86bf873390df587e84a50f578f863ee44

Download Submit
C:\Users\Admin\AppData\Local\Temp\e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e26b565cbe44e1fddb05dd5c304338bee6046d7df113d63fce5b78703e1c027aSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1084-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1536-138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4288-139-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download