ramnit | ab7c165d045887025bd15f013d51aa31a5535c2a393e985db4ebae3192d03a06

Analysis

max time kernel
131s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcdb556364d7542e7d28ad2c4d93ffc7_JaffaCakes118.html
Size

156KB
MD5

fcdb556364d7542e7d28ad2c4d93ffc7
SHA1

7c5ecfe3898338b0d78e166f3dfda01a363328f7
SHA256

ab7c165d045887025bd15f013d51aa31a5535c2a393e985db4ebae3192d03a06
SHA512

3cc8cfa17d9863aeecf94067898dd00ad53a5770a3507eb0c267e5384435b3f3a50049146aaabfb4d4d21c42b526675e808d04e68e81d223b4bc3192e259b82a
SSDEEP

1536:ivRTzIhzP6AZ2AyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:iBXAyfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
888	svchost.exe
1652	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2456	IEXPLORE.EXE
888	svchost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00370000000193a4-430.dat	upx
behavioral1/memory/888-435-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1652-448-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1652-446-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/888-440-0x0000000000240000-0x000000000026E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxC284.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C99B3A31-BD77-11EF-BDF2-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440712642"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1652	DesktopLayer.exe
1652	DesktopLayer.exe
1652	DesktopLayer.exe
1652	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2612	iexplore.exe
2612	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2612	iexplore.exe
2612	iexplore.exe
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE
3036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2456	2612	iexplore.exe	31
PID 2612 wrote to memory of 2456	2612	iexplore.exe	31
PID 2612 wrote to memory of 2456	2612	iexplore.exe	31
PID 2612 wrote to memory of 2456	2612	iexplore.exe	31
PID 2456 wrote to memory of 888	2456	IEXPLORE.EXE	36
PID 2456 wrote to memory of 888	2456	IEXPLORE.EXE	36
PID 2456 wrote to memory of 888	2456	IEXPLORE.EXE	36
PID 2456 wrote to memory of 888	2456	IEXPLORE.EXE	36
PID 888 wrote to memory of 1652	888	svchost.exe	37
PID 888 wrote to memory of 1652	888	svchost.exe	37
PID 888 wrote to memory of 1652	888	svchost.exe	37
PID 888 wrote to memory of 1652	888	svchost.exe	37
PID 1652 wrote to memory of 2248	1652	DesktopLayer.exe	38
PID 1652 wrote to memory of 2248	1652	DesktopLayer.exe	38
PID 1652 wrote to memory of 2248	1652	DesktopLayer.exe	38
PID 1652 wrote to memory of 2248	1652	DesktopLayer.exe	38
PID 2612 wrote to memory of 3036	2612	iexplore.exe	39
PID 2612 wrote to memory of 3036	2612	iexplore.exe	39
PID 2612 wrote to memory of 3036	2612	iexplore.exe	39
PID 2612 wrote to memory of 3036	2612	iexplore.exe	39

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcdb556364d7542e7d28ad2c4d93ffc7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:603146 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f89509a945922c06378f9d0f03fa8da7

SHA1
7bf916ec3eba400423fdea8fa666140bc6343d84

SHA256
7e15b0a5974ac86d68c7c4dfe1c1b33fa1fb020f823a6837edaecbaa9a12517e

SHA512
f4209bf72b4a013794d9c17673b395d6d919698bd9456d77fa71e1053dc4c4eca1167d4b093797a3d73655374543b3c33616b1f38ddc76d70a4ef99151bc4393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84c234b86020372f6cf3c449e0dba596

SHA1
c687f9d255d78d210e6d0e4850dd9a8aa9ed150b

SHA256
e6e6d55c71918cc6f2516096ed766f6987868954d97cb419bce2f62c1e8b4a42

SHA512
4af7b3490502691c993aa514f15b1a981528c89b5e7351d78499cfe53160b2ae05bdad185c1231c95c913c2cc7154b32de3e438e0fbd3f426e3a1a444c22514a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43f6154833ae7c083dbc588412e4c2ad

SHA1
a8d745580db996201568dc16520f6a9022514e76

SHA256
3f568d2d405d115927a059876de434d9b256b78ac36e51cae3173960622d2d54

SHA512
bdf1e51f2a98400d3d01c7162a084fd7670146962caa63fd64d00b708cf10268bf4b80e4698653d236b3c59e9e72b58837a6bdf1795b9d8f887c6349e648b20c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb9c19429c24ecf9c478a3e1b891639f

SHA1
904efa71a0f4a38741970b0c9c05c1ebfedd0604

SHA256
9310ac959d134873571f6d0fea2a8195cfee015f83496a8d703642e0fedaa521

SHA512
7b63595312a2eff3aefc5ed7929b87f45963b23ea3fd18acaa231a0f8a9fdfd11b8b68bc3e00991328d25832c4d1177545e4608634875ea8faa4a1b7153a4d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de17776e7ee7697e2b2e0963efeb4f96

SHA1
fd3ce7eb676b47733f80715b2c7f215a3b64d998

SHA256
445791b9bd64251dd9a4ab61923c29ddd37b69bca8a0ddc4063a8d53a66f92b2

SHA512
cc73b79737a77dccd07ff4600180e0a352262dc552464d22ab98498a316f0ccd7bfa6ef869d1904c20e4bb6ece8bc4906c0d948a649ee76809bcbb9d2592cd5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb1b478023042a57d63143647d33eae3

SHA1
3c6b4dadab4939d85cadf6d2cfc7284e40bd6178

SHA256
bffa34be7298229b3a5fa2135983b4a32aa7cfc9e4d35d3990ff4ac7072fbd8e

SHA512
193b7a21915300ed059285414cffe3c55f328757d01a0ec1dd7980ae8c6862b9f3782d911fe7ccfedb98aaa9cbb81de0fb414491986a61b7e1ff64b7e67f2c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6913aa651b549b84e29e07b06a7dbdb

SHA1
932085188ca3d03e3999285b9096461cdfad0656

SHA256
8e23ae8d38c02b3ae985619ebe9ae3a37a7b5d79c6627d6c6d64fb2892b00518

SHA512
c5b1969c768bd95b3ce49a06a817a20bf5d13ae44ddcf34e583ea3d0f4c91442c55adce55ab8858c44042564696d45905b6fb4228c9f900ecfdc7277d2e4f289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9388bc90626eb3822cfa4c4f96e7d77

SHA1
523d8f1ffb34ef454931ae270a3e2dc7deb847ac

SHA256
4b02abbcf682ceca8b8435426b1b9f8d21139a7389d98166aec048f829a6e3de

SHA512
9a7fd2b9d294c7c770b5621577cfc87e0afbcab3d148580e855a3224180d6dc8ce503a65135af9c99363b780df0ea3460393d0296ac4d459f107b9a5ff6e87f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bc8a888ceee1d15da8790fbc4431ead

SHA1
8d6de6a1c0cb355f3244f7a189c12907a2abf7fb

SHA256
998497a0b68164cda40e316391fe57589ced504de73332ab61f01a73ded659c8

SHA512
299708c746875b3cb13976f562b0a85f98ceb4f8d98bd4c0cc331c93f556b386482e0919ab808db4599bd3f3644cdebf319d3e901ad8bb5dcdfd3d361ebbf148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9671fbc971d8a4fed4fbc05120670215

SHA1
063744b7d71b0a0432727c63bee4ead296f07075

SHA256
f2fbfa9f14027d16ff71ef5fb9b0b457bc8f67bb06eef016b8535f8d6ba285c9

SHA512
19b218469e7ce6941775bb4483a1a48374bc04f6f58d126396e621895a9451aaf764506cf9c3193cab59be46a7a5d68865ad9eccdb09339a9e64c8294bd2593b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55d0514e0b0611f32c1677ed5447fcf7

SHA1
f949f36172ce046f68d5c3aa5e7a52986098331c

SHA256
771937669c35719e2711e7b6a737926192320f0c1fee631fc3d22dd451a086fd

SHA512
6e54293eef2b293f193023fb44a82ff47f087168ce46bb8b64639eec190afe28fdc7c74914bfd75e32a396c94a8e609dff1dbf910c7652bb262841c1befca4de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e6f0a329367dba3d7c0b7f831d3b632

SHA1
be2116f3f985b2d7bd14c883a04a5e821c660849

SHA256
2d8bf160094a3cb851ad380c27026892dd610028489011e633cee3ae78feafe1

SHA512
6165be477fc8c67f0dd44a3e2a1544ed72e68a60543d19991b14cbdeda0e7674880c578d921d7d0bb8bf2a43ddf6dea71b29fc6c88e60bda538a102b90131a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDF0B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE323.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/888-435-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/888-437-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/888-440-0x0000000000240000-0x000000000026E000-memory.dmp

Filesize
184KB

Download
memory/1652-446-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1652-449-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1652-445-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1652-448-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download