ramnit | eaeaa6cb2d401d175df7a74e3ba81330c1989b5db21d574fdbcb928d5c2f6bf1

Analysis

max time kernel
132s
max time network
133s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ded9fea10f84e794d1e4445d774b5ac8_JaffaCakes118.html
Size

162KB
MD5

ded9fea10f84e794d1e4445d774b5ac8
SHA1

6beaf366dff410ce4e4da2c9e309774891ba11d8
SHA256

eaeaa6cb2d401d175df7a74e3ba81330c1989b5db21d574fdbcb928d5c2f6bf1
SHA512

2eddf15d5a18e83eac9219edac2513c3e123c46b9c97e6fd25254b5c5044c531c2d9c69932c741ae5d399597116a238e9a55674bcd9889be30a1c0c092387498
SSDEEP

1536:imRTRrfi09ZWXYki3yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:iMF9Zx3yfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
1992	svchost.exe
3036	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2776	IEXPLORE.EXE
1992	svchost.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-434-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x002f0000000165b9-433.dat	upx
behavioral1/memory/1992-438-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1992-443-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3036-447-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3036-446-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3036-449-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3036-451-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px474.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A7BA911-B74A-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440033277"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3036	DesktopLayer.exe
3036	DesktopLayer.exe
3036	DesktopLayer.exe
3036	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2328	iexplore.exe
2328	iexplore.exe
1184	IEXPLORE.EXE
1184	IEXPLORE.EXE
1184	IEXPLORE.EXE
1184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2776	2328	iexplore.exe	31
PID 2328 wrote to memory of 2776	2328	iexplore.exe	31
PID 2328 wrote to memory of 2776	2328	iexplore.exe	31
PID 2328 wrote to memory of 2776	2328	iexplore.exe	31
PID 2776 wrote to memory of 1992	2776	IEXPLORE.EXE	36
PID 2776 wrote to memory of 1992	2776	IEXPLORE.EXE	36
PID 2776 wrote to memory of 1992	2776	IEXPLORE.EXE	36
PID 2776 wrote to memory of 1992	2776	IEXPLORE.EXE	36
PID 1992 wrote to memory of 3036	1992	svchost.exe	37
PID 1992 wrote to memory of 3036	1992	svchost.exe	37
PID 1992 wrote to memory of 3036	1992	svchost.exe	37
PID 1992 wrote to memory of 3036	1992	svchost.exe	37
PID 3036 wrote to memory of 2124	3036	DesktopLayer.exe	38
PID 3036 wrote to memory of 2124	3036	DesktopLayer.exe	38
PID 3036 wrote to memory of 2124	3036	DesktopLayer.exe	38
PID 3036 wrote to memory of 2124	3036	DesktopLayer.exe	38
PID 2328 wrote to memory of 1184	2328	iexplore.exe	39
PID 2328 wrote to memory of 1184	2328	iexplore.exe	39
PID 2328 wrote to memory of 1184	2328	iexplore.exe	39
PID 2328 wrote to memory of 1184	2328	iexplore.exe	39

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ded9fea10f84e794d1e4445d774b5ac8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:472074 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b84c559bd0524ce321adab6b49510b7

SHA1
f3c7c7f1ceccb5092fcb81c50b12641a2dac0ab2

SHA256
5dfb3b869d9bc35aaa8637a6bdfe5abf0935f503e5e4b2ea1aa19be7679ba9f5

SHA512
32d4a092e8aef389aeafb65f017aed88dff13ec90cfbb5a84ea5467bea5132f839cba4b242daa16845eadbff6735d56fdc571c2c3fb2a7a69757df7bb11d79ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2776770e16267281c8f9f37886c79e35

SHA1
82d3ecda7d27b4467db2905402f326812dbf296c

SHA256
2fe66bf61371470628c7b78540862310a0303bae522c3788b23c364bb0d8afb6

SHA512
6e48c7f69b06b6704d44426b2e8703c00f4e9638e5b2c0cd49fbfb065baf8c63985c3bc19c44d52a01e626d4673e2aba03ebb71c788ad8fe1c59afbd178d0927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a572d34efe9bc953639efba471be67b8

SHA1
c367dc383606dbce30af21498914ea6d055a5b17

SHA256
6d89aefdad62c15f804515206aa2d63d6c350aee0ad14ee977f664053462dd3b

SHA512
4dd5bb8dc5ae71a3438199d668112485fed7415458d3550b1f4969dd724a551223b1a55f978b0a34e8b40fb7b46b45ae4c3d46df964ee0d43659511fb8e3ccf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f98c4f3c3975c5f6142db70674cf0ef9

SHA1
df8dcde6c7f673c6669ee5bebd187310d887b1b2

SHA256
4f8bf2d5163ad5538fa59499c553db7d956f4e4f0a2b84c97733d111b29973c4

SHA512
da5291fd6f71663e776de322d233542cfa1f3ce94073b6c19be2398a44662835c8badd86adab5677706f6cba95bb5703920e4317408b2b24f934d67711b3c416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a96fb82174422b31ab7bcdbef94846fa

SHA1
367b4ce3180a2a797b0da64c49b3ece0580db9ea

SHA256
419a9be01c922375890974ab3a348769f5de47468b706cf617a3416cc220b8f4

SHA512
106e1988d47c483f89ebe1195634841ec2374e798fa91524563b68020b379f21c50f60784243cc4a77ed83efe306caa12de07f3ac17532e08016164447d3e603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab0a0d758dd4d26ce0cdfe3e78a8039e

SHA1
e10d77b7068bbbb836f08d8a19b2290d00f8da7c

SHA256
ef6fbe963898e075a743737e68e93c7582c4d5d1b407063d3024ea0128d80967

SHA512
950b417033bf722f7fd6e1dd3505f4741b0665797aa0d1f2aca7e9f79e1b087b13ef43d3a6eb260800f0e17afb345cb4126f7ecdd98a5add6cda0cbd2f0fe28e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2a693fdd74261946f767b4836fcb3d

SHA1
754208645a2e52cfd04a139419aabbd93c93768d

SHA256
62f9cf99f8071e32d738fbe8445b51a21507fbd79d4012c90f2597e0cf0ed41f

SHA512
d03004850153490983ac0577938b4633bc237f57de3ea304c01b49638bc1724136ecf459cc9aa7f75f1946a4e887e052d6c099c53d7e117a7b471e17c0ed7bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0fcb6cca1e524337a8f91065d47ee81

SHA1
64228458105112b939e07381e68108e42b2fa7bc

SHA256
dea9ba83fe7cbfcadf7105fa234e47c48d187f8db8fbad289e76ce64b8b77e13

SHA512
9951f42332f0473da8930924701ac9ff7b6e59bd6fcf765bdc94384701735488f09e023d38b56848397ab265f176117d3badc6ae8f1b3d6a37fdfc2100598de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdc504c8d530626b5ba83b5f15bf14b9

SHA1
da49dbb7d420516fc715a265fd13d5332bf834ce

SHA256
841614c02d660d81318a25780f0e3c3649e9d50e3032e338014993298fee8147

SHA512
f7a4092d0986694da7c59e512e1a0c946fb9a44f14f6972331b8d73ce5d168d691f78c9e3967cb4d63dd466611f668510f2eb8a949b1b854b2e2b897985d29ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fff77742d511ff9a3d9640e1d6ebf276

SHA1
b82cdc073717b70b5069ebde831f93a45f2d6169

SHA256
9c9a3855bc44d07f4cb79023524c5bfb362ea2b798a9c61f7d680462a3d81600

SHA512
b6c7b3b97e1b2865de2c346e9bb6063eb0beecef5a7cf15cf39271cb682a87cc767d59a69454159018e3a2a6796c515e0e9e2e9aa12dd5a05307c1b27d1e708c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d55c09a532b6daa76fe82be9f1d2fe0

SHA1
0da2d643090adef8c66b68ac25975296addc63fb

SHA256
0d23ecd38adb7d25a8d36da832a4ce407c2b50fbc72a077a4e85a2f496d3bbdf

SHA512
0a22856cec73cd18eec85bf314d5fe3cc92785570f567833884c4f22abacaa9802f6d9c988840ecc82d77aa063112e82261fe8c1ff8fff241d92a4c9a377018f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
182751b5745c2fdeaf1f187f6e85516c

SHA1
508bdd8d03ae834c80726db06f66efdb0c0ee647

SHA256
c53fcca6ab55e13b710be63acc7f834c9a503afef0ac4a7637b51b72d20b0f57

SHA512
bd35912781fea982278d0cd9d60d7f4756642b9bb1db254d5d5f220bc450d126977ddcaeec2155fb70c7cafc6226dc6d31fb063bc8102d8add83083db511773c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2464.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1992-434-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1992-443-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1992-435-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/1992-438-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3036-447-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3036-446-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3036-448-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3036-449-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3036-451-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download