ramnit | a3e823d2c1d5008d2f392a7178c32cfdddddc44d6aacabc9f6f47762c5fbd40b

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Size 228KB
Sample240626-sxx9qstdjp
SHA256 a3e823d2c1d5008d2f392a7178c32cfdddddc44d6aacabc9f6f47762c5fbd40b
MD5 127aeb2b2915e1737ab57c48e445d682
SHA1 3e044a7f90c56b7964e6dc140cb445e4eab64680
SHA512 f399914189a72176ca46234c2071b48b32a772ab475b76bb795eff58aca4992c4833ee150b30dc5f5b1c7600626f0f7e06f187384d2f34ca3392ff6695bb7843
SSDEEP 3072:Hr5mt+m6dyCBHSq9SkM81VF18nn3e7mKdC7SiNGTf3fifFyaLW/IxcM4yaD:HHbDwq9X11VF1u3e7LdAqPGFy0XxcX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Spy-Net = "C:\\Windows\\system32\\Spy-Net\\server.exe"	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Spy-Net = "C:\\Windows\\system32\\Spy-Net\\server.exe"	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CRO4GAU-D4L7-30D4-VDF0-S214GVKX165F}	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CRO4GAU-D4L7-30D4-VDF0-S214GVKX165F}\StubPath = "C:\\Windows\\system32\\Spy-Net\\server.exe Restart"	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2492	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118mgr.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2492-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2492-8-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2492-10-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1388-13-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2492-12-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2492-9-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2492-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2492-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1388-16-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1388-22-0x0000000010410000-0x0000000010446000-memory.dmp	upx
behavioral2/memory/1388-23-0x0000000010410000-0x0000000010446000-memory.dmp	upx
behavioral2/memory/1388-26-0x0000000010450000-0x0000000010486000-memory.dmp	upx
behavioral2/memory/1388-71-0x0000000010450000-0x0000000010486000-memory.dmp	upx
behavioral2/memory/1716-75-0x0000000010450000-0x0000000010486000-memory.dmp	upx
behavioral2/memory/1716-76-0x0000000010450000-0x0000000010486000-memory.dmp	upx
behavioral2/memory/1388-78-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1716-83-0x0000000010450000-0x0000000010486000-memory.dmp	upx
behavioral2/memory/1716-84-0x0000000010450000-0x0000000010486000-memory.dmp	upx
behavioral2/memory/1716-86-0x0000000010450000-0x0000000010486000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Spy-Net{3CRO4GAU-D4L7-30D4-VDF0-S214GVKX165F} = "C:\\Windows\\system32\\Spy-Net\\server.exe"	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{3CRO4GAU-D4L7-30D4-VDF0-S214GVKX165F} = "C:\\Windows\\system32\\Spy-Net\\server.exe"	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Spy-Net\logs.dat	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Spy-Net\logs.dat	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Spy-Net\server.exe	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Spy-Net\server.exe	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3600 set thread context of 1388	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	2492	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Token: SeDebugPrivilege	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Token: SeDebugPrivilege	1716	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
Token: SeDebugPrivilege	1716	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2492	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118mgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2492	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	90
PID 3600 wrote to memory of 2492	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	90
PID 3600 wrote to memory of 2492	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	90
PID 3600 wrote to memory of 1388	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	91
PID 3600 wrote to memory of 1388	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	91
PID 3600 wrote to memory of 1388	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	91
PID 3600 wrote to memory of 1388	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	91
PID 3600 wrote to memory of 1388	3600	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	91
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92
PID 1388 wrote to memory of 1740	1388	127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of UnmapMainImage
  PID:2492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 436
    3⤵
    - Program crash
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2492 -ip 2492
1⤵
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4212 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

127aeb2b2915e1737ab57c48e445d682_JaffaCakes118mgr.exe

Path C:\Users\Admin\AppData\Local\Temp\127aeb2b2915e1737ab57c48e445d682_JaffaCakes118mgr.exe
Size 84KB
SHA256 9030a2ec813b5a70b898aacd81378c941bc5f62e78cc1a958f93106ede81228c
MD5 a6ee7aab6b8f8268bf9eb763949d5c8b
SHA1 4600e17eb8fa4a11170aaa2c54d98126e58290e0
SHA512 00569ed578d3f0b535b0c17dc131131e4aaf73b8b5235c70fcf8de649e8a942f48a013e8c687c6abab05a8f7516dabed41309da6ce7c9eb26992183e4794afb8
SSDEEP 1536:B+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZG:B+FDzK71QkbstyJjCKICpC72s/mlaXG
MD5 SHA1 SHA512 SSDEEP

Submit Download

~TMEB0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\~TMEB0C.tmp
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1388-71-0x0000000010450000-0x0000000010486000-memory.dmp

Download

memory/1388-16-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1388-26-0x0000000010450000-0x0000000010486000-memory.dmp

Download

memory/1388-22-0x0000000010410000-0x0000000010446000-memory.dmp

Download

memory/1388-78-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1388-13-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1388-23-0x0000000010410000-0x0000000010446000-memory.dmp

Download

memory/1716-74-0x00000000035B0000-0x00000000035B1000-memory.dmp

Download

memory/1716-75-0x0000000010450000-0x0000000010486000-memory.dmp

Download

memory/1716-27-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1716-76-0x0000000010450000-0x0000000010486000-memory.dmp

Download

memory/1716-84-0x0000000010450000-0x0000000010486000-memory.dmp

Download

memory/1716-86-0x0000000010450000-0x0000000010486000-memory.dmp

Download

memory/1716-83-0x0000000010450000-0x0000000010486000-memory.dmp

Download

memory/1716-28-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/2492-9-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2492-5-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2492-8-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2492-6-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2492-7-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2492-21-0x0000000077AF2000-0x0000000077AF3000-memory.dmp

Download

memory/2492-12-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2492-20-0x0000000077AF2000-0x0000000077AF4000-memory.dmp

Download

memory/2492-14-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/2492-10-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3600-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3600-15-0x0000000000400000-0x000000000043B000-memory.dmp

Download