ramnit | e56f1aa14f898bca8ac8a528532b9ddae3a15d8bb4b049435009836e7ce954f7

Analysis

max time kernel
136s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9c74a1ebd42f321df6b2c1dd56fea53_JaffaCakes118.html
Size

125KB
MD5

f9c74a1ebd42f321df6b2c1dd56fea53
SHA1

3ed6287a456cdefab62bb7f7e2e4f98e49d55b8f
SHA256

e56f1aa14f898bca8ac8a528532b9ddae3a15d8bb4b049435009836e7ce954f7
SHA512

c79d7250c5dfa89372555fae1e6770287653adc72d43f308678a6ee33455c5dd9e93dcb3e09fae8054db4564c0201252c7c7012148c083bbb37af510cb1fe957
SSDEEP

1536:xj7dyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:x3dyfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2812	svchost.exe
1632	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2784	IEXPLORE.EXE
2812	svchost.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-19-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x00060000000195d0-17.dat	upx
behavioral1/memory/1632-16-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1632-21-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2812-13-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2812-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px5A12.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000727359a3ba040e47baf4d14b0e96b6b9000000000200000000001066000000010000200000000785f405cb62cba3e03e1f6e91c71286903ebc9e5598647b4df4628cc8ffc6a7000000000e8000000002000020000000a6c000b91f4c7ae86d00c563cf615277639000227150b20609149f2d5ccdedee20000000a1a614106472417c802d0f4da95b1f7bbd82faa448113d1e039000a6de612502400000004949d8864a0b4666dcd243bd4b9788aa439afb36dc6026065b6949e0b3ee915cb350b7e09eeddb45706c751707b18474d83ba4ad24691321a71d78cb8382e43f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440651383"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000727359a3ba040e47baf4d14b0e96b6b900000000020000000000106600000001000020000000b388acf24a444c15c1b5db1075fa328ccc894970dc280374cf8d371d8c52bfa6000000000e800000000200002000000028b921b31272c70da8dd383d33fd7f58d9bfe9e5071f66cec11923daa156d69590000000cf1c9a138f69500e9d02d83a3412739d806c9a4d5b41ec05f249bf15ecb9afc3a43faf1776a3d8eaeeff0f3589a2216430336b765eb27461b16ee7080388eb9034bc547faf651e8ac4069bd369329da5a031572f74a5b42f9f5c87e0d22d08048f3673528a7fd75be8d2942e34198dc98942485a633998a2f8d48242c6834c1c7d6ce93d296e258ce8a5ad63183d383640000000c59794530daff86572284009fb0be46b15cf26949d554a020245fa1468ed80abcd510d5287be52d6fdffade4670b8c3c9de1d46d29c00d02c452adc71f9b3f6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D287A21-BCE9-11EF-9D33-D6FE44FD4752} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d5fc40f650db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1632	DesktopLayer.exe
1632	DesktopLayer.exe
1632	DesktopLayer.exe
1632	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2364	iexplore.exe
2364	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2784	2364	iexplore.exe	30
PID 2364 wrote to memory of 2784	2364	iexplore.exe	30
PID 2364 wrote to memory of 2784	2364	iexplore.exe	30
PID 2364 wrote to memory of 2784	2364	iexplore.exe	30
PID 2784 wrote to memory of 2812	2784	IEXPLORE.EXE	31
PID 2784 wrote to memory of 2812	2784	IEXPLORE.EXE	31
PID 2784 wrote to memory of 2812	2784	IEXPLORE.EXE	31
PID 2784 wrote to memory of 2812	2784	IEXPLORE.EXE	31
PID 2812 wrote to memory of 1632	2812	svchost.exe	32
PID 2812 wrote to memory of 1632	2812	svchost.exe	32
PID 2812 wrote to memory of 1632	2812	svchost.exe	32
PID 2812 wrote to memory of 1632	2812	svchost.exe	32
PID 1632 wrote to memory of 2624	1632	DesktopLayer.exe	33
PID 1632 wrote to memory of 2624	1632	DesktopLayer.exe	33
PID 1632 wrote to memory of 2624	1632	DesktopLayer.exe	33
PID 1632 wrote to memory of 2624	1632	DesktopLayer.exe	33
PID 2364 wrote to memory of 2788	2364	iexplore.exe	34
PID 2364 wrote to memory of 2788	2364	iexplore.exe	34
PID 2364 wrote to memory of 2788	2364	iexplore.exe	34
PID 2364 wrote to memory of 2788	2364	iexplore.exe	34

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9c74a1ebd42f321df6b2c1dd56fea53_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275464 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d53effa216d0f021bfe365c29f221d

SHA1
21c13486c2e5fc23d36b8c9e225b132a03357873

SHA256
e220c189128f500dd979ed1b5eec34186931e0cdc5ec96c2df7e9e7915e0e396

SHA512
f38d5460e43beeb0bd5446bac98851a2f72d504b0f346171e15b1e944ce1ed195878c9267029fa1b9bec9eb10a55b1b06e55453b442466f8027fdf77cbc39871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e87f286dfbcd16d541b04cb940a8b53e

SHA1
b839c468c1ee5b9275013f92e280829f13a055bd

SHA256
1809f6b8b932146a65a24336671d629ffde9ce3301a7c0b177fde10b6d8687c8

SHA512
183d80027e780cc00620b312f9ddee0bb7fdb7520ef368e582502fe836874bf5d55b2d7e2e7ff260269d9c6c911975ff595c359f42677e5693d789031ccc17d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e0cc94fb631075d7d6a72f8fd7f02c9

SHA1
c1d87adb97cde5cd6123336b24ca637069561531

SHA256
19dd93d486bc3911b8c3a74e20dfd49f4e8fc8b11a302f8e3376009ea03b2ff1

SHA512
4cdb8bff0f69414609696b3ef0832c210153ad878804f6c3774ded18380b70a518472e046bd8a6cf7b0d3896c2dc9a62b752863ddacc1dc56fd320a4c0f1add6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db7fb50f1e8506cf9b76954453182fac

SHA1
6b6fe8cf95afaa36de9a0e6d1f6959377499116c

SHA256
077055255fa919f819830f3c17a6e0ccac24e40a530257521ea613e65b3fb2b0

SHA512
aa1bbee97a1db2fbad13db5c461cb62dc4a873c12c22530f8d1b3e56c756b25ad064805f1525af64f65dc2dd8c0431a642a0fb498d5512af8ec0e1fb7615e83e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
020e99852cfc9bd9d812e27004339f72

SHA1
a8ba7173d3feb59a3f8b1ff7f383a0d6725797da

SHA256
03f4b10d3404e9e743bee022016cf7a619cd7d3ddd1c2c903e5a80e99a9faf43

SHA512
ab6fff0d9fe00da1262207d7a7b0cc67b256f42c2dfb18d4430be06192b014d2c966e0349f850fc41ea26a4f1fb19c82e2f605d35e08ff81c2658027a7801ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
560e838f9d4edb6d782e1d2f1f8db6f2

SHA1
89e7267b97a57e74c99cd14ea1546f2409b88c80

SHA256
21895ee841d4e87b56f947a1bd821c98edcb3f9ea3cd3f37a712def8b4354198

SHA512
ec6546fc2f2da9dd5c7d02cb3246d8e5414b1b3bc45e50e59226f3af790090e3e6699f90f4cac0b2cf8a31523bdadf61f55c0825ba1e67f44ea23782966e4d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f7e3bdffff676c40de9e89ebfd4e69a

SHA1
a4cccd1a63afd2c0dced2b2c7e2842f7b37001eb

SHA256
f29e9caddfaca453dd3382574ac79707daf15fd469e5e09f602b6830ec11aaee

SHA512
76841f03e6ade69184f43f5c5ecdae651d2494f79537c98903f2f10547b383f60380bbb20e9d39c0da23aefdd9799a9df1ef0e399861ab30c4164dc449f30f73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d78ec97d8d9aa3bd792487e2879ff51a

SHA1
30944706a7d2f15d0b2de6e1d62e12e705cb2f4f

SHA256
2c046bd59264b75e88c4d14fb728aa36b3419e8eadfa3f8da89474b0ca024647

SHA512
fc80635dd696bce9f21949f3b36b5bd74d28dbd874f4a911f3a381c74f1d9a5500ed266b6c4c5f063ca5ec9ba8420a9b4bcd115ded9bd443300d1d613d8e2ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5764.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5814.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1632-16-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1632-21-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1632-20-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1632-18-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/1632-19-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2812-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2812-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2812-14-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download