ramnit | 7e5833acd8f5773bae6b800c7a0ba78d52641ea7ce1108f5a22f64f01db07342

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f04cb3a991002dad8c1da1cc239e8d2a_JaffaCakes118.dll
Size

468KB
MD5

f04cb3a991002dad8c1da1cc239e8d2a
SHA1

29f74b97a0d20691b904954c6941657cb9da0906
SHA256

7e5833acd8f5773bae6b800c7a0ba78d52641ea7ce1108f5a22f64f01db07342
SHA512

90b55ebc79ca057199e46017352533f17ab0558e8b96ebd314c614da9433f3ecd72be66420fc61bf518da663595a4e8f9522bbd70ae69dbfb10a7b287a988f10
SSDEEP

12288:coz83OtIEzW+/m/AyF7bCrO/ExF16u5ktOqk:xbIEzW+/m/rF7kc813eOqk

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 6 IoCs

pid	Process
2300	rundll32mgr.exe
1640	rundll32mgrmgr.exe
3596	WaterMark.exe
408	WaterMark.exe
2892	WaterMarkmgr.exe
3176	WaterMark.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2892-53-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3596-63-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2892-65-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/408-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1640-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2300-24-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2300-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2300-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2300-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2300-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2300-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2300-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3596-85-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/408-84-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3596-87-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB6EC.tmp	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB779.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB6DC.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5052	4620	WerFault.exe	96
4580	1756	WerFault.exe	92
3668	3304	WerFault.exe	93
2544	2012	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440969066"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1939540613"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1939540613"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31149661"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1936103029"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31149661"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9EEA2016-BA50-11EF-BDBF-CAF61997B0B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31149661"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9EE2D302-BA50-11EF-BDBF-CAF61997B0B0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1936103029"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31149661"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1936103029"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1939696612"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31149661"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
3596	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
408	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe
3176	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	WaterMark.exe
Token: SeDebugPrivilege	408	WaterMark.exe
Token: SeDebugPrivilege	3176	WaterMark.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3892	iexplore.exe
1816	iexplore.exe
2224	iexplore.exe
2500	iexplore.exe
4956	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
1816	iexplore.exe
1816	iexplore.exe
2500	iexplore.exe
2500	iexplore.exe
2224	iexplore.exe
2224	iexplore.exe
3892	iexplore.exe
3892	iexplore.exe
4956	iexplore.exe
4956	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
3732	IEXPLORE.EXE
3732	IEXPLORE.EXE
4840	IEXPLORE.EXE
4840	IEXPLORE.EXE
3468	IEXPLORE.EXE
3468	IEXPLORE.EXE
1412	IEXPLORE.EXE
1412	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
2300	rundll32mgr.exe
1640	rundll32mgrmgr.exe
3596	WaterMark.exe
408	WaterMark.exe
2892	WaterMarkmgr.exe
3176	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2012	1768	rundll32.exe	83
PID 1768 wrote to memory of 2012	1768	rundll32.exe	83
PID 1768 wrote to memory of 2012	1768	rundll32.exe	83
PID 2012 wrote to memory of 2300	2012	rundll32.exe	84
PID 2012 wrote to memory of 2300	2012	rundll32.exe	84
PID 2012 wrote to memory of 2300	2012	rundll32.exe	84
PID 2300 wrote to memory of 1640	2300	rundll32mgr.exe	85
PID 2300 wrote to memory of 1640	2300	rundll32mgr.exe	85
PID 2300 wrote to memory of 1640	2300	rundll32mgr.exe	85
PID 2300 wrote to memory of 3596	2300	rundll32mgr.exe	87
PID 2300 wrote to memory of 3596	2300	rundll32mgr.exe	87
PID 2300 wrote to memory of 3596	2300	rundll32mgr.exe	87
PID 1640 wrote to memory of 408	1640	rundll32mgrmgr.exe	88
PID 1640 wrote to memory of 408	1640	rundll32mgrmgr.exe	88
PID 1640 wrote to memory of 408	1640	rundll32mgrmgr.exe	88
PID 3596 wrote to memory of 2892	3596	WaterMark.exe	89
PID 3596 wrote to memory of 2892	3596	WaterMark.exe	89
PID 3596 wrote to memory of 2892	3596	WaterMark.exe	89
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 3596 wrote to memory of 1756	3596	WaterMark.exe	92
PID 2892 wrote to memory of 3176	2892	WaterMarkmgr.exe	91
PID 2892 wrote to memory of 3176	2892	WaterMarkmgr.exe	91
PID 2892 wrote to memory of 3176	2892	WaterMarkmgr.exe	91
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 408 wrote to memory of 3304	408	WaterMark.exe	93
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3176 wrote to memory of 4620	3176	WaterMark.exe	96
PID 3596 wrote to memory of 4956	3596	WaterMark.exe	102
PID 3596 wrote to memory of 4956	3596	WaterMark.exe	102
PID 3596 wrote to memory of 2224	3596	WaterMark.exe	103
PID 3596 wrote to memory of 2224	3596	WaterMark.exe	103
PID 408 wrote to memory of 2500	408	WaterMark.exe	104
PID 408 wrote to memory of 2500	408	WaterMark.exe	104
PID 408 wrote to memory of 3892	408	WaterMark.exe	105
PID 408 wrote to memory of 3892	408	WaterMark.exe	105
PID 3176 wrote to memory of 1816	3176	WaterMark.exe	106
PID 3176 wrote to memory of 1816	3176	WaterMark.exe	106
PID 3176 wrote to memory of 1900	3176	WaterMark.exe	107
PID 3176 wrote to memory of 1900	3176	WaterMark.exe	107
PID 1816 wrote to memory of 3732	1816	iexplore.exe	108
PID 1816 wrote to memory of 3732	1816	iexplore.exe	108
PID 1816 wrote to memory of 3732	1816	iexplore.exe	108
PID 2500 wrote to memory of 3468	2500	iexplore.exe	109

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f04cb3a991002dad8c1da1cc239e8d2a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f04cb3a991002dad8c1da1cc239e8d2a_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:408
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 204
        7⤵
        Program crash
        
        PID:3668
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3468
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3892 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2516
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        7⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 212
        8⤵
        Program crash
        
        PID:5052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1816 CREDAT:17410 /prefetch:2
        8⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1900
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:1756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 204
        6⤵
        Program crash
        
        PID:4580
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4956
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4956 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1412
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 608
    3⤵
    - Program crash
    PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2012 -ip 2012
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1756 -ip 1756
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3304 -ip 3304
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4620 -ip 4620
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
07e369ebdbb322a72367beb15fea66c2

SHA1
7772c54598e1862ebffe373b494651ec745f6c9f

SHA256
b50e533aec8439f67cd49f1119099293c18626136694d72fc4c5b00f950e8e0c

SHA512
65f401db96f0e2c1a1ae79528087ff3e2e24bb5353425ecf93c884519aaf950422a6599f2e3afe6839070071d033ea8d19c546d5493aa511beb97c6fea5ba0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
37429dcdf4458996b874da639afc8467

SHA1
a7a3909194c88a5451a1c243bb7f027e7973b77a

SHA256
ff9cd9b11bd5818234057cd525b0ad9b8d9dc12242a73fe0ecfb5a9a9ff482a6

SHA512
e874ff13a8bcbcfd99d62c66c8e13ba1fb69b253daf6abc4189699f62badf14673e5aa716c0765ef7af550557430908d98a2d9d7ffa4bfdc93ab7447f85cce03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
2b75bcd1f040ca6b4a10dded7804019a

SHA1
40c8fa8105dfebc80221d7060af13e7ca75f7b37

SHA256
516d26869c20dabfe0d22151e091080daad845b50ce6e027ee30195411adc5ac

SHA512
f5ab389a0a420f9c86f7f46b0c5d40eec8b8c614809c4741cf9a9a52ed4e0a3deae830f36361ba9340e3a08bc6aa9dd73c8f3dbd6b3ec30ace9a4c3907883edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
f1253095ae44d8fd3a2081b3a2a4d01b

SHA1
80e0ac06e3f2596fc36116d20d744bc600717e39

SHA256
58b03887bf79e97bc311e446a92333797d4dc65d81640f7fb112d6d46455ec7d

SHA512
22ef5b7618fa1a31b3d434461241d977e3ab169a97bdc99a2baa8833a79a9df049b6e5fb636849c47803263068a3bd73c11e0040162a3375d3971bbf7ec86e6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
ae533bd4bfba1190d285896d4411f993

SHA1
9f105dbfad5ad41c63b86a41729b99ae4ea2971a

SHA256
712cee0d51555c57e868b9d6be37e2d14d06bb7e39643a4ca0db49a0d163cfa9

SHA512
7f13f1c0195b3d1f4b423f7046c7424283f6fe4edf02ba00cd9e6ee8c9394356d262e15145729b5129b94a0ece9be25f84dda09440e5832491b7e4922ee05e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9EE2D302-BA50-11EF-BDBF-CAF61997B0B0}.dat

Filesize
3KB

MD5
ee04df081baed44eafe94dc6b3905e2a

SHA1
9abf74e4d16d8952adfd002ef04d49eea85aa312

SHA256
f80a432d7630d9dd6f0526f1ddbe2e0c896d8cbd70b960733c7feb513759e5f5

SHA512
ace4198d9fe853764a1ec7644fa1ec014c3b64d5379395195e6a3baef5d7e9f9ecb398a6f8f940a3772d1ac67dbd7497cab6f7aaddc9cd0c4989c3b135fb1876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9EE9F906-BA50-11EF-BDBF-CAF61997B0B0}.dat

Filesize
5KB

MD5
18f2f58cca626684259f142484579525

SHA1
2a48297bd0edbf39d5ba42e197f7e7d797cbef85

SHA256
4696bc71bc321a194076591d67e42b9d3b5ed6188d1ee7702a05b2ee4e2cb730

SHA512
0a2d2cd9d7f53164c86430f7a30d5d870f055ce6c453f5f31211cfd3f40b4bd16e4534605303a87571d5bcc7dfd38d5eca36c5222283c0287d38c22e2bef0186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9EEA2016-BA50-11EF-BDBF-CAF61997B0B0}.dat

Filesize
3KB

MD5
9d311da524002e9748c7909a26b45b3c

SHA1
ea22a825b5c2d2731d9213178423940078ee2076

SHA256
9e43ed71f1e85c6498e828ac964ba91eb697aa2bd7b4a117d3a0fcf46f517c69

SHA512
da51486cebc1ae5c6085077f0fe46bddbe2d74c5dea8a5d0de7ee2462fcb20d8b02652e10a131b3dfe0a3f30d4169d3964ed1897ed146e96823addeaec93364d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9EEA2016-BA50-11EF-BDBF-CAF61997B0B0}.dat

Filesize
5KB

MD5
067b5bc2c89b61972e069bf46afeb4a9

SHA1
a3b095e8f62f6c3accc7aa48d333dd33f61bcc85

SHA256
b49c2bfe2107dce9375c420a9037cc7c79aba4ce1355aefafff675652e4a989f

SHA512
caa5766a1bfd0779e8fc0d6d2f24626d0ae7c51049986123a4388602e58d69dbde551a9d0cab0efe08f32cc71d5114cd42db2e31774306cf783b9a99b2ded885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9EEEBDDA-BA50-11EF-BDBF-CAF61997B0B0}.dat

Filesize
5KB

MD5
984a967058d66d929aef4f785630c651

SHA1
828db0d9ea21939ebef3423c4655f51859411529

SHA256
7bf56ed7a3ccebf60f6c69ff874afabea41ea5f9f75a8b52033f45221af4c9b4

SHA512
e4711f05681a1fc0518c3268f9e25f9000dbeb01cb6f1b5d447e49ba56cfbb5d865bec34d660dd0f80f6331645ce87325787f5e2d0d925cc73cfc11c102230b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3A74.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
122KB

MD5
c5255edf109342e3e1d1eb0990b2d094

SHA1
ba029b47b9b3a5ccccae3038d90382ec68a1dd44

SHA256
ea49164b416d1b900f80a14f30295ea7d546483a0d7ba8b3a9e48dbcb48a3dc5

SHA512
6b6911ea424763af3ed4964e67aa75d1ffe74551e1e4e12e6220afcda720dbfdda00d744e23486c07701662bac3702220f760d1c86a188772e9bf8af7b64a3a3

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
59KB

MD5
f2c8b7e238a07cce22920efb1c8645a6

SHA1
cd2af4b30add747e222f938206b78d7730fdf346

SHA256
6b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e

SHA512
c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699

Download Submit
memory/408-84-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/408-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/408-60-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/408-78-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/1640-14-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1640-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2012-76-0x000000007C340000-0x000000007C3B6000-memory.dmp

Filesize
472KB

Download
memory/2012-1-0x000000007C340000-0x000000007C3B6000-memory.dmp

Filesize
472KB

Download
memory/2300-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2300-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2300-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2300-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2300-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2300-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2300-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2300-16-0x0000000001900000-0x0000000001901000-memory.dmp

Filesize
4KB

Download
memory/2300-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2892-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2892-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3176-68-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3596-87-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3596-85-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3596-77-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/3596-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3596-56-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/3596-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download