ramnit | c526cb59f58c54a03823cd99af2579319560fa4244e2818c5f2ea5ec330aeead

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe
Size

180KB
MD5

f6f8ebb4df7bc3d77b3d53677c4d48cb
SHA1

f3e342c6be5ac445a1e46c27711061f77a787e02
SHA256

c526cb59f58c54a03823cd99af2579319560fa4244e2818c5f2ea5ec330aeead
SHA512

7902b542fa99eb0ac18bdb55b6243616b283f126248b4610b08d44ae44925b5e40bd857ec06fdab311caa3df402bc76d49eb66fd71340ab0dd922450b070c87d
SSDEEP

3072:BDbWOntusSGID19zQoMeyYX5KHn7g6VfJn5f6KdhWaA8:B2OIsSbxSnm2tRJnP

Score

10^/10

ramnit banker defense_evasion discovery evasion persistence spyware stealer trojan worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\fwhyrgve\\ndylcjfu.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ndylcjfu.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ndylcjfu.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
1080	fitgelebajuihpby.exe

Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	svchost.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	svchost.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	svchost.exe

Loads dropped DLL 12 IoCs

pid	Process
2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe
2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
1080	fitgelebajuihpby.exe
1080	fitgelebajuihpby.exe
1080	fitgelebajuihpby.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\NdyLcjfu = "C:\\Users\\Admin\\AppData\\Local\\fwhyrgve\\ndylcjfu.exe"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\atiilhag.inf	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe
File opened for modification	C:\Windows\INF\atiriol6.inf	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fitgelebajuihpby.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
Token: SeDebugPrivilege	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
Token: SeSecurityPrivilege	2112	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeDebugPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	1080	fitgelebajuihpby.exe
Token: SeLoadDriverPrivilege	1080	fitgelebajuihpby.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2724	2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2724	2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2724	2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2724	2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2724	2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2724	2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2724	2220	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe	31
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2112	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	32
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 2624	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	33
PID 2724 wrote to memory of 1080	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	34
PID 2724 wrote to memory of 1080	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	34
PID 2724 wrote to memory of 1080	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	34
PID 2724 wrote to memory of 1080	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	34
PID 2724 wrote to memory of 1080	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	34
PID 2724 wrote to memory of 1080	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	34
PID 2724 wrote to memory of 1080	2724	f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe	34

C:\Users\Admin\AppData\Local\Temp\f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Checks BIOS information in registry
    - Drops startup file
    - Impair Defenses: Safe Mode Boot
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\fitgelebajuihpby.exe
    "C:\Users\Admin\AppData\Local\Temp\fitgelebajuihpby.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f6f8ebb4df7bc3d77b3d53677c4d48cb_JaffaCakes118mgr.exe

Filesize
111KB

MD5
7b3937ba0cd79cb981ed7b9d0c6b339c

SHA1
a3af75465e95755aaa71aa7fbc65054cde91d9a6

SHA256
cb920c3bc8a7c6afb29be87021f296845e9312f40df424d1bf2047d056b202d2

SHA512
81282176368c27da4941afeab8728f5797ac0491cfb42796733a5ebc235c46e3f35ca636de71be265c4faac8f73bd3c3d76eec9801242c6aa41b7c732377104a

Download Submit
memory/1080-104-0x0000000000400000-0x0000000000437D08-memory.dmp

Filesize
223KB

Download
memory/1080-101-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download
memory/1080-96-0x0000000000400000-0x0000000000437D08-memory.dmp

Filesize
223KB

Download
memory/2112-34-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2112-33-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2112-35-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2112-37-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2112-36-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2112-22-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2112-24-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2112-28-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2112-32-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2220-15-0x0000000000430000-0x0000000000468000-memory.dmp

Filesize
224KB

Download
memory/2220-16-0x0000000000430000-0x0000000000468000-memory.dmp

Filesize
224KB

Download
memory/2220-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2220-78-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/2220-1-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/2220-77-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2220-2-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/2624-50-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-110-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-59-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-114-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-65-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-113-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-112-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-66-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-40-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-111-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-58-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-105-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-106-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-107-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-108-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2624-109-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/2724-17-0x0000000000400000-0x0000000000437D08-memory.dmp

Filesize
223KB

Download
memory/2724-94-0x0000000000400000-0x0000000000437D08-memory.dmp

Filesize
223KB

Download
memory/2724-92-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2724-20-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2724-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download