Overview

overview

10

Static

static

3

ea69cbd4ce...18.exe

windows7-x64

10

ea69cbd4ce...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 06:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea69cbd4cef47b051db7a16308ec764b_JaffaCakes118.exe

  • Size

    108KB

  • MD5

    ea69cbd4cef47b051db7a16308ec764b

  • SHA1

    d6e3a85a10e31876a2ef250f85a66f91bf21293e

  • SHA256

    1abe45aa3042f4085101cf285a456c80c9e6f0189a6965e440c9f8ca33d99304

  • SHA512

    310ff8e047d557770124bdcd9180adabe290793528e7e13dd9990b0041ecaac17c44f53d5f31df833a64843592f453fb8f06ad2df5b839b309d2ed5021176ee3

  • SSDEEP

    3072:1DahPBarKpbqAC3gNFmfnAZ1+cpVZX8nLlKSI7da0wL7MI:AhPBarKptTmfAZ1QnkBaXL5

Score
10/10
ramnitbankerdiscoveryevasionpersistencespywarestealertrojanupxworm

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Ramnit family
    ramnit
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 19 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 28 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:332
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:380
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:484
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:592
                  • C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Windows\system32\wbem\wmiprvse.exe
                    4⤵
                      PID:1636
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      4⤵
                        PID:1716
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                        4⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        PID:1828
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:668
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:748
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:816
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1168
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:852
                                • C:\Windows\system32\wbem\WMIADAP.EXE
                                  wmiadap.exe /F /T /R
                                  4⤵
                                    PID:2152
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService
                                  3⤵
                                    PID:964
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k NetworkService
                                    3⤵
                                      PID:108
                                    • C:\Windows\System32\spoolsv.exe
                                      C:\Windows\System32\spoolsv.exe
                                      3⤵
                                        PID:1008
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                        3⤵
                                          PID:1076
                                        • C:\Windows\system32\taskhost.exe
                                          "taskhost.exe"
                                          3⤵
                                            PID:1116
                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                            3⤵
                                              PID:1432
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                              3⤵
                                                PID:2084
                                              • C:\Windows\system32\sppsvc.exe
                                                C:\Windows\system32\sppsvc.exe
                                                3⤵
                                                  PID:2576
                                              • C:\Windows\system32\lsass.exe
                                                C:\Windows\system32\lsass.exe
                                                2⤵
                                                  PID:492
                                                • C:\Windows\system32\lsm.exe
                                                  C:\Windows\system32\lsm.exe
                                                  2⤵
                                                    PID:500
                                                • C:\Windows\system32\csrss.exe
                                                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                  1⤵
                                                    PID:396
                                                  • C:\Windows\system32\winlogon.exe
                                                    winlogon.exe
                                                    1⤵
                                                      PID:432
                                                    • C:\Windows\Explorer.EXE
                                                      C:\Windows\Explorer.EXE
                                                      1⤵
                                                        PID:1200
                                                        • C:\Users\Admin\AppData\Local\Temp\ea69cbd4cef47b051db7a16308ec764b_JaffaCakes118.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\ea69cbd4cef47b051db7a16308ec764b_JaffaCakes118.exe"
                                                          2⤵
                                                          • Modifies WinLogon for persistence
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          • Loads dropped DLL
                                                          • Modifies system executable filetype association
                                                          • Adds Run key to start application
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2920
                                                          • C:\Users\Admin\AppData\Local\Temp\ea69cbd4cef47b051db7a16308ec764b_JaffaCakes118mgr.exe
                                                            C:\Users\Admin\AppData\Local\Temp\ea69cbd4cef47b051db7a16308ec764b_JaffaCakes118mgr.exe
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of UnmapMainImage
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2948
                                                            • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                              "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of UnmapMainImage
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2696
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                C:\Windows\system32\svchost.exe
                                                                5⤵
                                                                • Modifies WinLogon for persistence
                                                                • Drops file in System32 directory
                                                                • Drops file in Program Files directory
                                                                • System Location Discovery: System Language Discovery
                                                                PID:300
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                C:\Windows\system32\svchost.exe
                                                                5⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2296
                                                          • C:\Windows\SysWOW64\dllChache\Empty.jpg
                                                            C:\Windows\system32\dllChache\Empty.jpg ReStart
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2056
                                                          • C:\Windows\SysWOW64\dllChache\Blank.doc
                                                            C:\Windows\system32\dllChache\Blank.doc ReStart
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Enumerates connected drives
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:296
                                                          • C:\Windows\SysWOW64\dllChache\Zero.txt
                                                            C:\Windows\system32\dllChache\Zero.txt ReStart
                                                            3⤵
                                                            • Modifies WinLogon for persistence
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Modifies visiblity of hidden/system files in Explorer
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Modifies system executable filetype association
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1820
                                                          • C:\Windows\SysWOW64\dllChache\Hole.zip
                                                            C:\Windows\system32\dllChache\Hole.zip ReStart
                                                            3⤵
                                                            • Modifies WinLogon for persistence
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1908
                                                          • C:\Windows\SysWOW64\dllChache\Unoccupied.reg
                                                            C:\Windows\system32\dllChache\Unoccupied.reg ReStart
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:860
                                                          • C:\Windows\SysWOW64\explorer.exe
                                                            "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ea69cbd4cef47b051db7a16308ec764b_JaffaCakes118
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2480

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Winlogon Helper DLL

                                                      1
                                                      T1547.004

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Change Default File Association

                                                      1
                                                      T1546.001

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Winlogon Helper DLL

                                                      1
                                                      T1547.004

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Change Default File Association

                                                      1
                                                      T1546.001

                                                      Defense Evasion

                                                      Hide Artifacts

                                                      2
                                                      T1564

                                                      Hidden Files and Directories

                                                      2
                                                      T1564.001

                                                      Modify Registry

                                                      6
                                                      T1112

                                                      Credential Access

                                                      Discovery

                                                      Peripheral Device Discovery

                                                      1
                                                      T1120

                                                      Query Registry

                                                      1
                                                      T1012

                                                      System Information Discovery

                                                      2
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Lateral Movement

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
                                                        Filesize

                                                        134KB

                                                        MD5

                                                        c160d436f0c34b6dced871f0f9e6a586

                                                        SHA1

                                                        ff0eb8da116c8b248db0c54eac4254e73c2f6b05

                                                        SHA256

                                                        b92713cba31544d4d58e984364100be03677d20c189a61d92b5dde2eccb55903

                                                        SHA512

                                                        6161e5b33cfaef7133245748836162915a98e8c5b1b6b455f4ebd40712423bd32b1dbaa66e1cb0f66e804116f03117494c9e9dc756c613aa195a4e6b8252098d

                                                        Download Submit

                                                      • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
                                                        Filesize

                                                        130KB

                                                        MD5

                                                        44349c7e95fac240e7da239cade99660

                                                        SHA1

                                                        09d9955fbf65b9d894f99881dbeb736ddd3d9196

                                                        SHA256

                                                        0c065e883bbc06da20238be93534df20ffc76c42a20c97e9ae3ea11fbbd7ac2a

                                                        SHA512

                                                        95797bea564b8cc8d5c585f4448678daf42a574bf407a582b5e950703b6cb673759334fe4eceba3fb36bd67f52f6ef7c205c98ccabf2245f9ec13a49924e0a63

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\ea69cbd4cef47b051db7a16308ec764b_JaffaCakes118mgr.exe
                                                        Filesize

                                                        60KB

                                                        MD5

                                                        f4f27869cdedbb0d9d1996d33be2c8a1

                                                        SHA1

                                                        277b2df1585794b40b51053af2aeaf88ce40474a

                                                        SHA256

                                                        1c81a61ce416989fcdc5a72585933e60f68a21d952733afd65092156c3c253a1

                                                        SHA512

                                                        8656ba9d9618954026fee9ca48d701b10d336eba0549ad506bc91df26b647be1db265062112a4699ca554c8dda2c7a4706055474cd0b127eefff1086c840dfd8

                                                        Download Submit

                                                      • C:\Windows\SysWOW64\dllChache\MSVBVM60.DLL
                                                        Filesize

                                                        1.3MB

                                                        MD5

                                                        5343a19c618bc515ceb1695586c6c137

                                                        SHA1

                                                        4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                        SHA256

                                                        2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                        SHA512

                                                        708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                        Download Submit

                                                      • C:\Windows\SysWOW64\dllchache\Zero.txt
                                                        Filesize

                                                        108KB

                                                        MD5

                                                        ea69cbd4cef47b051db7a16308ec764b

                                                        SHA1

                                                        d6e3a85a10e31876a2ef250f85a66f91bf21293e

                                                        SHA256

                                                        1abe45aa3042f4085101cf285a456c80c9e6f0189a6965e440c9f8ca33d99304

                                                        SHA512

                                                        310ff8e047d557770124bdcd9180adabe290793528e7e13dd9990b0041ecaac17c44f53d5f31df833a64843592f453fb8f06ad2df5b839b309d2ed5021176ee3

                                                        Download Submit

                                                      • memory/296-161-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/300-101-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/300-75-0x0000000000080000-0x0000000000081000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/300-84-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/300-88-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/300-89-0x0000000000080000-0x0000000000081000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/300-99-0x0000000000090000-0x0000000000091000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/300-91-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/300-100-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/300-144-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/300-73-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/860-835-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/1820-570-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/1820-132-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/1828-165-0x00000000039A0000-0x00000000039B0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/1908-573-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2056-152-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2296-186-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2296-169-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                        Download

                                                      • memory/2296-182-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                        Download

                                                      • memory/2296-179-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                        Download

                                                      • memory/2296-183-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2296-184-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                        Download

                                                      • memory/2296-185-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                        Download

                                                      • memory/2296-187-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                        Download

                                                      • memory/2696-54-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2696-72-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/2696-842-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2696-167-0x0000000000060000-0x0000000000061000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2696-128-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2696-55-0x0000000076F7F000-0x0000000076F80000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2696-65-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2920-142-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-0-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-141-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-143-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-162-0x0000000002610000-0x0000000002620000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/2920-103-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-164-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-17-0x0000000000240000-0x0000000000261000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2920-146-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-112-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-52-0x0000000000400000-0x000000000042D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-117-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2920-11-0x0000000000240000-0x0000000000261000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2920-129-0x0000000000260000-0x000000000028D000-memory.dmp

                                                        Filesize

                                                        180KB

                                                        Download

                                                      • memory/2948-27-0x0000000000050000-0x0000000000071000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-14-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-20-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-21-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-23-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-13-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-12-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-18-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                        Download

                                                      • memory/2948-19-0x0000000000150000-0x0000000000151000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download