ramnit | 8e90725d9113336e23602c796ece027dadcadf68dd7d60c7f3f20536734cca47

Analysis

max time kernel
136s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a36c16f9c5dd86b4ec7c20e15c39c46c_JaffaCakes118.html
Size

125KB
MD5

a36c16f9c5dd86b4ec7c20e15c39c46c
SHA1

8684278ed7eff547adde51cb7f7c671bb76eadc9
SHA256

8e90725d9113336e23602c796ece027dadcadf68dd7d60c7f3f20536734cca47
SHA512

6c3316f5e41504761d6d94a73b06a72ce70c9f5df3c0bd64b0290d87e1cac422582cb845c91284b2812037ea43c4ad1ea33e3e1627d4da4d52fe3681d1e46aec
SSDEEP

1536:V02PzyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:V9zyfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
2588	svchost.exe
2996	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
1816	IEXPLORE.EXE
2588	svchost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000164b2-2.dat	upx
behavioral1/memory/2588-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2588-10-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2588-9-0x0000000000240000-0x000000000024F000-memory.dmp	upx
behavioral1/memory/2996-19-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px2626.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80cd0cbf33bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB76C371-2926-11EF-9CEF-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002115f1b1e4650d4abace13295ded2fa900000000020000000000106600000001000020000000360ad55d4360e3d4d09e23bfc660319c32d6a81011bb12fbd3a59e4b800775e0000000000e80000000020000200000007d8ffef1f24b4cc9e28b546ad991298a5f15c6152d7c6ce9f8492fd4f9732aa690000000fa107abef5508f4fceb9facd125155e031f5136ec95f1edde399bb58b8b499c0b5a1523952f63982bdd0684385b188294534aa681d6af76e1e27c722a45cdcf6f9b0b7868e2eaa0caeb30edbee2c79c9570bd1149a00b74511a73f89b3b7c256b99b57d3ef36f6d4ba3cb1014609cab005945003bd925c026232ab10d42de972e79aa665e7664f155715ba191d88f35e400000009e01632e20d96c3cccf5d5cceee508199dbb5bf0a586b09d7658fe9cce70a81ccb71729b760ab4d667ac6ebf63574c9f79f2de3cb2acea78d1326e05469afb81	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002115f1b1e4650d4abace13295ded2fa9000000000200000000001066000000010000200000006db4d03c1838038402f30eb202e089a59a4469ed617694f245e12e02d19c434d000000000e8000000002000020000000d4d0de5fc28ba86bb8eb9fd3fda0a06b3720558219d139efff5bd2cd7e8cdf5020000000f086245213a8d12380a0310a74e1ba34a5e7aab0330efcf54e8b0e14d1f7d409400000009d39a0d900d68035d2283d2cc1f80480d79242919c685f86e1c204eab53174d15ee54de64630e7d2bddb070329b81f71aa7fa3f2a421a884126c7a655aeaef1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424405021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2996	DesktopLayer.exe
2996	DesktopLayer.exe
2996	DesktopLayer.exe
2996	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
1816	IEXPLORE.EXE
1816	IEXPLORE.EXE
2820	iexplore.exe
2820	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1816	2820	iexplore.exe	28
PID 2820 wrote to memory of 1816	2820	iexplore.exe	28
PID 2820 wrote to memory of 1816	2820	iexplore.exe	28
PID 2820 wrote to memory of 1816	2820	iexplore.exe	28
PID 1816 wrote to memory of 2588	1816	IEXPLORE.EXE	29
PID 1816 wrote to memory of 2588	1816	IEXPLORE.EXE	29
PID 1816 wrote to memory of 2588	1816	IEXPLORE.EXE	29
PID 1816 wrote to memory of 2588	1816	IEXPLORE.EXE	29
PID 2588 wrote to memory of 2996	2588	svchost.exe	30
PID 2588 wrote to memory of 2996	2588	svchost.exe	30
PID 2588 wrote to memory of 2996	2588	svchost.exe	30
PID 2588 wrote to memory of 2996	2588	svchost.exe	30
PID 2996 wrote to memory of 2612	2996	DesktopLayer.exe	31
PID 2996 wrote to memory of 2612	2996	DesktopLayer.exe	31
PID 2996 wrote to memory of 2612	2996	DesktopLayer.exe	31
PID 2996 wrote to memory of 2612	2996	DesktopLayer.exe	31
PID 2820 wrote to memory of 2604	2820	iexplore.exe	32
PID 2820 wrote to memory of 2604	2820	iexplore.exe	32
PID 2820 wrote to memory of 2604	2820	iexplore.exe	32
PID 2820 wrote to memory of 2604	2820	iexplore.exe	32

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a36c16f9c5dd86b4ec7c20e15c39c46c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275464 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c57a09f592d74930a6f3c1db06c7af43

SHA1
42b39369cdedbe1419c2a975fe8393e14303d2e7

SHA256
b3663113cdb5c5bf15e47cca4db787b0e7ac2baa1535e4daa88a2ac5b3fe4c58

SHA512
5ee4222ef41248191c749570b38f314766daccaa63046fa60ab0fa9f233ac1985a7fbe754f9089fc87e02296f8dd8504c96cf2160b1f320a16e29c42f0749653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d931ec86f989f52481ef8545ed8085c7

SHA1
620b22a3da959c035ab2f367c8d092fbd25cb8a3

SHA256
55d1fd0e937b981f72bffb3efcd2f1aa562309d6b8f7b8669e68df26a7d2592d

SHA512
954f9aaea6ba4aaa605e4881e928569fe7ef4fcc296c8d87e7e1e9a66fa33d8523674845cdff604179a6554efa6ad58f33a52d86036899741c6817122b5dc506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
349337f77fd1ecff0e9358319ead14c6

SHA1
4d8de3e1011a7a9a1d42b6ba26dcf1644133cf91

SHA256
8e23c61ac1ae61e87696ec321b61f9ca04004c69ae229ad6d51c0a7ae2c650f6

SHA512
0664ca0f02c03ce69f574c01565f6202999101a7db9d08868912a0bad239527d275416f63e9b71082aa777a4f664e8abe82ac95ae8698a92ff460768a8522459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27182dba81ddbb9bfedae505a19623e3

SHA1
fbf19f9f448d4314f356e14ae4161e3042e32207

SHA256
667f8876132eff5fb70ce12c4111e5a870b6d0a22b6f4a19e359a668b1be3f8c

SHA512
01a4844631ce26a85cf8398b01cd8346dfa9bb9bd0434df060671dccace18456e0c061754ba14eac6e24af8720aa9511a1966052eb1c775db253764be330a3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4911dec773623f135c2a7743f3e414c

SHA1
5e0ae1194cedc8722bb5f36bc1a260eb7b48cf80

SHA256
133d79bd31aa1d2055e0738a1e2b9cc4a12d783e510e335b0c3033e9802b7605

SHA512
7513e7fae622c8e29de4af4a065a474c6d630899160665c6fe1f3c3d1eda37a7bd3ed59bc50a5e53b200e79aca058d92caf6c6a0f115b6fe1eba4233161abf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
138a3fd6b8ca46af5aa9aae8a53a2509

SHA1
24da6a3ecf4297d9c8bbc87e2ef904af4ca68014

SHA256
7c9c10bacc6c0676e8df2328f2125003fbc1ca1b0743a11bb9c0307aa91e5d6e

SHA512
ea878dd697317a99bf14b3e279dd43595e06ad31710315b6a7b76be1678c5a37d66c68e390248566f61453dfa8eb91a0c933b47cf77ec24f6cfc0a4b0cde0d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d804ed3d594a26c150195e70c9432634

SHA1
86ab1a429c2599e5de5b991eba829b4d7734ef20

SHA256
5739c8c6837b2ccb65b026278d0a0adb4619924322412912d11c470f852dd14b

SHA512
7806ab0e81a029277d42a05cb7ee60db89850ef07ff69bb9b386d9a7007975e9db05dd216906fa7ab2a968e89b8eb9ecc860fb6bf48ada94b4e2bb84ec76dfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4d070769f1816e333f99198ccddafe3

SHA1
d590f93d5170ed389ca5a365bea658ab33be70f2

SHA256
a402ad3cb4389088ad53253869dbf0e91a42c79b7b4ac6e1bc1b5a342ddef892

SHA512
8e69b9424ed2311eb5edb0e3a0e220f25f8b646d71d19b55181b62aef2867a613e236164846c10ff02f53af4835fc3d90e4b96e2a930e77502de63d84c2b12af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c526b58b1495ebfd1fd9945d9aa4c52

SHA1
f081b2e939b61f791b79446673de889e76411850

SHA256
6c59e8fc9f1716cc7c7d3156490a4f098b0ddafcaf5c70ea84011d219d690083

SHA512
84d96eb8bcbc9d886ebd568b271ef77d7e57067228cce818634d82cf26cd99426b1b377113a83f43aebd7291e4ff70a8d72c114b44a8f192871358f67a6b911f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22CE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23A0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/2588-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2588-10-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2588-9-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/2996-19-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2996-17-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download