Overview

overview

10

Static

static

e32ab7cabe...29.exe

windows7-x64

10

e32ab7cabe...29.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529.exe

  • Size

    252KB

  • MD5

    43bd08991f7824b978d998ab7a9b0600

  • SHA1

    5e1ae02400e5854c87781a3547e143d31d85312c

  • SHA256

    e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529

  • SHA512

    cd353c7f7104b6dc58a75c4c0a52b049fcc61ccdf6eba923d6f3539584c8ea7f2905bda01cc344f0d9dc579932ae317cef9e0699f1c0614c74dd6a2e54c68d80

  • SSDEEP

    3072:mR2xn3k0CdM1vabyzJYWqaH87onClrA42s8Y/DH8CBDKQ4soITntOOzs1lEaX:mR2J0LS6VdAClrA42ZYrN2Q4ctOOojEM

Score
10/10
ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\dwm.exe
    "dwm.exe"
    1⤵
      PID:376
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\fontdrvhost.exe
        "fontdrvhost.exe"
        1⤵
          PID:792
        • C:\Users\Admin\AppData\Local\Temp\e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529.exe
          "C:\Users\Admin\AppData\Local\Temp\e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529.exe"
          1⤵
          • UAC bypass
          • Windows security bypass
          • Disables RegEdit via registry modification
          • Windows security modification
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:928
          • C:\Users\Admin\AppData\Local\Temp\e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529mgr.exe
            C:\Users\Admin\AppData\Local\Temp\e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529mgr.exe
            2⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:2004
            • C:\Program Files (x86)\Microsoft\WaterMark.exe
              "C:\Program Files (x86)\Microsoft\WaterMark.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4844
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\system32\svchost.exe
                4⤵
                  PID:4860
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 204
                    5⤵
                    • Program crash
                    PID:4224
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  4⤵
                  • Modifies Internet Explorer settings
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2904
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:17410 /prefetch:2
                    5⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:2044
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  4⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4776
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4776 CREDAT:17410 /prefetch:2
                    5⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:2392
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall set opmode disable
              2⤵
              • Modifies Windows Firewall
              PID:4888
            • C:\Program Files (x86)\Microsoft\WaterMark.exe
              "C:\Program Files (x86)\Microsoft\WaterMark.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4908
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\system32\svchost.exe
                3⤵
                  PID:4856
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  3⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2708
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:17410 /prefetch:2
                    4⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:2212
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  3⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1468
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1468 CREDAT:17410 /prefetch:2
                    4⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:3776
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4860 -ip 4860
              1⤵
                PID:5116

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\WaterMark.exe
                Filesize

                65KB

                MD5

                849ef19ec0155d79d4fa5bfb5657b106

                SHA1

                eb7e7ff208ecb40d35755d8f36e31e2482166299

                SHA256

                8b853e963eab5aa857b640be1d07d605a8bf6dd8bdf8884505b05034bbd87e04

                SHA512

                30384d9943f7eca4efbdcac52d3dd9c14446a2d75dc04ce4047feabe037c5177138f6bdcb055939dcc47608dfb50a54c9676f795d850c9a9de353f90252053a2

                Download Submit
              • C:\Program Files (x86)\Microsoft\WaterMark.exe
                Filesize

                65KB

                MD5

                849ef19ec0155d79d4fa5bfb5657b106

                SHA1

                eb7e7ff208ecb40d35755d8f36e31e2482166299

                SHA256

                8b853e963eab5aa857b640be1d07d605a8bf6dd8bdf8884505b05034bbd87e04

                SHA512

                30384d9943f7eca4efbdcac52d3dd9c14446a2d75dc04ce4047feabe037c5177138f6bdcb055939dcc47608dfb50a54c9676f795d850c9a9de353f90252053a2

                Download Submit
              • C:\Program Files (x86)\Microsoft\WaterMark.exe
                Filesize

                65KB

                MD5

                849ef19ec0155d79d4fa5bfb5657b106

                SHA1

                eb7e7ff208ecb40d35755d8f36e31e2482166299

                SHA256

                8b853e963eab5aa857b640be1d07d605a8bf6dd8bdf8884505b05034bbd87e04

                SHA512

                30384d9943f7eca4efbdcac52d3dd9c14446a2d75dc04ce4047feabe037c5177138f6bdcb055939dcc47608dfb50a54c9676f795d850c9a9de353f90252053a2

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                471B

                MD5

                e32d02ce684c01ef3af05fae9066160e

                SHA1

                29c7a6e8ed553ac2765634265d1db041d6d422ec

                SHA256

                b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

                SHA512

                e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                471B

                MD5

                e32d02ce684c01ef3af05fae9066160e

                SHA1

                29c7a6e8ed553ac2765634265d1db041d6d422ec

                SHA256

                b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

                SHA512

                e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                471B

                MD5

                e32d02ce684c01ef3af05fae9066160e

                SHA1

                29c7a6e8ed553ac2765634265d1db041d6d422ec

                SHA256

                b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

                SHA512

                e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                471B

                MD5

                e32d02ce684c01ef3af05fae9066160e

                SHA1

                29c7a6e8ed553ac2765634265d1db041d6d422ec

                SHA256

                b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

                SHA512

                e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                b2254121f846144f0a00288c8560a83a

                SHA1

                7eac9424677f5378d84b0a707f6c3bf53d3c766d

                SHA256

                b9a11e6dd7da288a96e8a56746388e6ac493c09074430a7cb209c88788bdd1dd

                SHA512

                3182b63ce0274c0c9e4454992b0fa43d10729cc1502a641eb4f6c26e0d55e0371381c97a5f87e8a9fefb41474eb1d55b9f141251295e8046af9b7a3a62f740ad

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                7dffb4ebeb53449935972c33cecf0f6b

                SHA1

                239a3152b953075468dccf6168c53b028994bf35

                SHA256

                8cce031dc71db42bb3f50af3e9e12573d6750ee5f9850f53ab23ac14417cc7f1

                SHA512

                72b4caf690f57aeac1b99c31a63dfa49cffadb2c40be5c82fe60b3489e532f9c7821d03317bfc0e95742a8b5dc644d99af7d47ff0b17cfabfc3577d650cead93

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                7dffb4ebeb53449935972c33cecf0f6b

                SHA1

                239a3152b953075468dccf6168c53b028994bf35

                SHA256

                8cce031dc71db42bb3f50af3e9e12573d6750ee5f9850f53ab23ac14417cc7f1

                SHA512

                72b4caf690f57aeac1b99c31a63dfa49cffadb2c40be5c82fe60b3489e532f9c7821d03317bfc0e95742a8b5dc644d99af7d47ff0b17cfabfc3577d650cead93

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                7dffb4ebeb53449935972c33cecf0f6b

                SHA1

                239a3152b953075468dccf6168c53b028994bf35

                SHA256

                8cce031dc71db42bb3f50af3e9e12573d6750ee5f9850f53ab23ac14417cc7f1

                SHA512

                72b4caf690f57aeac1b99c31a63dfa49cffadb2c40be5c82fe60b3489e532f9c7821d03317bfc0e95742a8b5dc644d99af7d47ff0b17cfabfc3577d650cead93

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                b32abbecf38a95204d6956691ce99b3a

                SHA1

                3fc5470e097d65ca30055a4c09db15c6fc88f356

                SHA256

                236bd1971e7937c15b99cef6b0c35b99acddbcad0b2d2bd5bbe600cd6b24a784

                SHA512

                d11b1a764eb3ea554977c9379b930cb3eb2c42acecae906181426cfe6f555e9bd56874a040b0ec05d34373a078777c6a139da7fe02cd500e0bb19ddd74bdce94

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                b32abbecf38a95204d6956691ce99b3a

                SHA1

                3fc5470e097d65ca30055a4c09db15c6fc88f356

                SHA256

                236bd1971e7937c15b99cef6b0c35b99acddbcad0b2d2bd5bbe600cd6b24a784

                SHA512

                d11b1a764eb3ea554977c9379b930cb3eb2c42acecae906181426cfe6f555e9bd56874a040b0ec05d34373a078777c6a139da7fe02cd500e0bb19ddd74bdce94

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                b32abbecf38a95204d6956691ce99b3a

                SHA1

                3fc5470e097d65ca30055a4c09db15c6fc88f356

                SHA256

                236bd1971e7937c15b99cef6b0c35b99acddbcad0b2d2bd5bbe600cd6b24a784

                SHA512

                d11b1a764eb3ea554977c9379b930cb3eb2c42acecae906181426cfe6f555e9bd56874a040b0ec05d34373a078777c6a139da7fe02cd500e0bb19ddd74bdce94

                Download Submit
              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DA62295B-6B5A-11ED-AECB-5E3721E937B7}.dat
                Filesize

                5KB

                MD5

                cb821645e1c424d275e312b75377aab5

                SHA1

                17637f042e0de46640c4c7f9ed56d5975ee0165b

                SHA256

                16ddd167a286f6f6b88a137dfeca57aea16012c9c847d5b21073a61999e4cac1

                SHA512

                602027d56ccbbb4efdf17fe87ff5df108dc41be0864a36c4705ed5e607bf2a7a5f109659383d85c5e2f9780fc8a5e5f611ce4ca5a0bc3c36e2e86afb17cdbb53

                Download Submit
              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DA62506B-6B5A-11ED-AECB-5E3721E937B7}.dat
                Filesize

                3KB

                MD5

                f9b65d41457aa40d2a8d7a2fc1918a59

                SHA1

                f5b0a25028054637b524ed3b9eafd3081d9d97ec

                SHA256

                151d57a3da114fb09f690a4f97d0ef307fae815bd243976e53b9d00124c5a49e

                SHA512

                068312735bbf163b4bf7e86602a04995c5636bf1454073428bee28f791f9ee976a120c481ce826aaec31c707b3d0c42ab17e0052184253b13ca7651c2e9ae20e

                Download Submit
              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DA62777B-6B5A-11ED-AECB-5E3721E937B7}.dat
                Filesize

                5KB

                MD5

                18757b892c3b6c02ca74872843d30a21

                SHA1

                3edfcdd0fdeaff576bd19c62cd3084c33ae84e5a

                SHA256

                52f0b89db2bbe5617aa0487dea61149be0acccf20103b8fb90d140f1f9306708

                SHA512

                753508b774bfdaea28468dab2b15ae8f139e8a5bd673404614f59bafeed906a82578fac0ee07f50de42d4f43e3d294d96955d7146b2b32ed1df1e5e0e64eca83

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529mgr.exe
                Filesize

                65KB

                MD5

                849ef19ec0155d79d4fa5bfb5657b106

                SHA1

                eb7e7ff208ecb40d35755d8f36e31e2482166299

                SHA256

                8b853e963eab5aa857b640be1d07d605a8bf6dd8bdf8884505b05034bbd87e04

                SHA512

                30384d9943f7eca4efbdcac52d3dd9c14446a2d75dc04ce4047feabe037c5177138f6bdcb055939dcc47608dfb50a54c9676f795d850c9a9de353f90252053a2

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\e32ab7cabe965e4c4228c3ecb9a67dff169295bddb56d34789a34f7bdf8e4529mgr.exe
                Filesize

                65KB

                MD5

                849ef19ec0155d79d4fa5bfb5657b106

                SHA1

                eb7e7ff208ecb40d35755d8f36e31e2482166299

                SHA256

                8b853e963eab5aa857b640be1d07d605a8bf6dd8bdf8884505b05034bbd87e04

                SHA512

                30384d9943f7eca4efbdcac52d3dd9c14446a2d75dc04ce4047feabe037c5177138f6bdcb055939dcc47608dfb50a54c9676f795d850c9a9de353f90252053a2

                Download Submit
              • memory/928-136-0x0000000003490000-0x00000000044C1000-memory.dmp
                Filesize

                16.2MB

                Download
              • memory/928-139-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/928-154-0x0000000003490000-0x00000000044C1000-memory.dmp
                Filesize

                16.2MB

                Download
              • memory/928-162-0x0000000003490000-0x00000000044C1000-memory.dmp
                Filesize

                16.2MB

                Download
              • memory/928-132-0x0000000000400000-0x000000000044A000-memory.dmp
                Filesize

                296KB

                Download
              • memory/928-144-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/928-151-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/2004-146-0x00000000004A0000-0x00000000004C1000-memory.dmp
                Filesize

                132KB

                Download
              • memory/2004-133-0x0000000000000000-mapping.dmp
                Download
              • memory/2004-143-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/4844-163-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/4844-165-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/4844-140-0x0000000000000000-mapping.dmp
                Download
              • memory/4844-157-0x0000000000460000-0x0000000000481000-memory.dmp
                Filesize

                132KB

                Download
              • memory/4844-145-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/4856-155-0x0000000000000000-mapping.dmp
                Download
              • memory/4860-152-0x0000000000000000-mapping.dmp
                Download
              • memory/4888-148-0x0000000000000000-mapping.dmp
                Download
              • memory/4908-147-0x0000000000000000-mapping.dmp
                Download
              • memory/4908-156-0x0000000000550000-0x0000000000571000-memory.dmp
                Filesize

                132KB

                Download
              • memory/4908-158-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download
              • memory/4908-164-0x0000000000400000-0x0000000000421000-memory.dmp
                Filesize

                132KB

                Download