ramnit | 5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
Size

282KB
MD5

0e560da43934d4d2da7e1a7da5ebfd2d
SHA1

d1af6e0d9901a8f3dbbc1dee3c571331f6eb2333
SHA256

5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a
SHA512

9853ae076f5ee2cb0845d544753db3faa32ddaa134aedef27d132c35e71520703777fd8f01c13ffe3b04be2948c0662e7f037f108f360879830fe8a5f6c4a858
SSDEEP

6144:OLukrrarV55qNTMA4LBf0dJ5TTBZbspom7bXG:hkr055qNTQN0VTTbM/2

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe

Loads dropped DLL 2 IoCs

pid	Process
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000120f6-2.dat	upx
behavioral1/memory/2552-13-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2552-15-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2552-24-0x0000000000400000-0x0000000000464000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B71C8A01-C892-11EF-A5CD-E699F793024F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B723AE21-C892-11EF-A5CD-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441933661"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe

Suspicious behavior: MapViewOfSection 24 IoCs

pid	Process
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
Token: SeDebugPrivilege	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2680	iexplore.exe
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2680	iexplore.exe
2680	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2552	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	28
PID 3068 wrote to memory of 2552	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	28
PID 3068 wrote to memory of 2552	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	28
PID 3068 wrote to memory of 2552	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	28
PID 2552 wrote to memory of 2680	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	29
PID 2552 wrote to memory of 2680	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	29
PID 2552 wrote to memory of 2680	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	29
PID 2552 wrote to memory of 2680	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	29
PID 2552 wrote to memory of 2720	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	30
PID 2552 wrote to memory of 2720	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	30
PID 2552 wrote to memory of 2720	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	30
PID 2552 wrote to memory of 2720	2552	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe	30
PID 3068 wrote to memory of 384	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	3
PID 3068 wrote to memory of 384	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	3
PID 3068 wrote to memory of 384	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	3
PID 3068 wrote to memory of 384	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	3
PID 3068 wrote to memory of 384	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	3
PID 3068 wrote to memory of 384	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	3
PID 3068 wrote to memory of 384	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	3
PID 3068 wrote to memory of 392	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	4
PID 3068 wrote to memory of 392	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	4
PID 3068 wrote to memory of 392	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	4
PID 3068 wrote to memory of 392	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	4
PID 3068 wrote to memory of 392	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	4
PID 3068 wrote to memory of 392	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	4
PID 3068 wrote to memory of 392	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	4
PID 3068 wrote to memory of 432	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	5
PID 3068 wrote to memory of 432	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	5
PID 3068 wrote to memory of 432	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	5
PID 3068 wrote to memory of 432	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	5
PID 3068 wrote to memory of 432	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	5
PID 3068 wrote to memory of 432	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	5
PID 3068 wrote to memory of 432	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	5
PID 3068 wrote to memory of 476	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	6
PID 3068 wrote to memory of 476	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	6
PID 3068 wrote to memory of 476	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	6
PID 3068 wrote to memory of 476	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	6
PID 3068 wrote to memory of 476	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	6
PID 3068 wrote to memory of 476	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	6
PID 3068 wrote to memory of 476	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	6
PID 3068 wrote to memory of 492	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	7
PID 3068 wrote to memory of 492	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	7
PID 3068 wrote to memory of 492	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	7
PID 3068 wrote to memory of 492	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	7
PID 3068 wrote to memory of 492	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	7
PID 3068 wrote to memory of 492	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	7
PID 3068 wrote to memory of 492	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	7
PID 3068 wrote to memory of 500	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	8
PID 3068 wrote to memory of 500	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	8
PID 3068 wrote to memory of 500	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	8
PID 3068 wrote to memory of 500	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	8
PID 3068 wrote to memory of 500	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	8
PID 3068 wrote to memory of 500	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	8
PID 3068 wrote to memory of 500	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	8
PID 3068 wrote to memory of 616	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	9
PID 3068 wrote to memory of 616	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	9
PID 3068 wrote to memory of 616	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	9
PID 3068 wrote to memory of 616	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	9
PID 3068 wrote to memory of 616	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	9
PID 3068 wrote to memory of 616	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	9
PID 3068 wrote to memory of 616	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	9
PID 3068 wrote to memory of 688	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	10
PID 3068 wrote to memory of 688	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	10
PID 3068 wrote to memory of 688	3068	5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe	10

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:616
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:688
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:776
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:832
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1044
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:872
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:984
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:300
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1088
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1108
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1156
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2984
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2012
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1080
- C:\Users\Admin\AppData\Local\Temp\5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe
  "C:\Users\Admin\AppData\Local\Temp\5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607a.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
    C:\Users\Admin\AppData\Local\Temp\5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2496
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2720
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e63b559dd06ddf3dfa14941f6572c997

SHA1
e5441992013603bf79ca06450b3a31513afa14f3

SHA256
2ec53dcb004e80c729ce132e4cb822941756a95b2528f4d6f9ef88109a04f6e2

SHA512
1a62d56e072826edcab0eed6f0fa18ea8c63fccdfa07fc9c085c4a485c90960a250285147a7be72d1197cb60c65b458fb54bfd0fa3240dd8e64cace13f20bca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60a91429aa138be92d26876c9c457415

SHA1
fb0361dcea5769deb432ac7cdfb064f0ce6bea57

SHA256
31061201054c1ca6889326d3356b376b804c01ce21e93f558222087df4ca5666

SHA512
b92f6f16099c4292fe1b9c83f55808100bea087f7cf005a62714c270fc68f3d63ad7caab799265a4870e70df1844eb21e0770d5053a0c52a04734736b0fa7e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aab49dbd67efa50ad733844f0dc63f9

SHA1
efd5e3b58b69d8f9d6dbc3162e107ba8fb59bd1a

SHA256
5cbb696b3cc7565e1bfd8cff8f754ab6c185c0f8af62b64801b5f96c9eb72810

SHA512
b025f602569ce255835c9aca6236224c501b978bc28fa6ebcdc519e2aa0ff46a7983a8312500d8456021989fbc7c9b52b623009a709caeb711f833ed5756dfa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29e49137245eb6f9d34482167546917d

SHA1
7f397bd9758cdf9642ce28299ce381e2de45af15

SHA256
3266dfed366c3f17e603892461d28eb887d797ff4dbd8f863301a31cb4cf2bfb

SHA512
72946d2cc742c453922aca1eee15c73838a69341982ed381fad84a4073ceb88af53c50c9159cf7b33ae06bf4ffcff62231086c1f3b5664817bc74dba10749560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
840824d7bf4218bc2b2d5587e865c508

SHA1
742659490923deeb269e6947b338fde0bd11bc50

SHA256
4294443651520482289eef83bda9c387c742341c3b2957a81f979c1d79fa6ec3

SHA512
f34ed4ce010cb1574ff0b6306901b1f8419a35928f615451bb423156fd37c1e0a7c19fb9b15d40a0c48ed633a311908b5f94f3f82beb7dd40ce3d95eb9c3ad9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2709bd7533d86460e19b8f41ed0faea1

SHA1
515480867d9c14e6e658ff202e0d2f6680ed69fd

SHA256
28dfac4fad612c9396604af126d3179a72b23895291826bd490901017eff5481

SHA512
3dc1b50c6e054598903e3b252c6c72ff5564ffb600a324e3a9e9aaa1510a8ad1701d9254bfc2a7c883c0dce77bf53f6de53323d3d8a7867cbbc4da5055932f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ca472fac2983a8953835a63ec5e3aad

SHA1
494ac06e86d1611d95a8f4084dd969f9560fc843

SHA256
a654bc5844028beb8da066920636740dde2b1a992f3a880ebd50fb27db477dfc

SHA512
11fea72dd08c24a3cb3847ead56c2258422a9d50af7b5c8f45fdf5bbdb7b2ebaf2a44ee6fda10958f6086806bb3aca2600b6c31edaa90f21bb2fc4b55d9c9f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
813a20a68c892ba12ff945f1916c6958

SHA1
b8825b11faf373fd658b0882fc8eb80b8d7404d0

SHA256
1ff1fcf1d78e1f51778c9aca1b2bbd08a203a55e4791c22b44c365f6af453bb1

SHA512
feb4f46828198c21caad7f53b975365d9b2108683c1d2319f49f47257f266bdb7a9de40a711171952dd3b26a91be0451c262adfeff68347f6f12155375ddb3b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f34584b3c624ac09650d817530993c32

SHA1
844ec19d554c2219f3a334c9c4e2efd336356ad4

SHA256
defd6d3a1ab180ea02955adf5d2d94b76c1e651df0144cc100c36cf28e24cfcb

SHA512
c0384c6350bd04422038389505a7b974a22a2b87d985e74bc835c6c3647dff6e8979d7d8962532eb491a9c4e7727a3e080983c0900cb43f45fd1c3b8fb64d724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dd7f132e94082c55d40f1c706ac950a

SHA1
0023b3e9f534604dbd985f4c01c0d22022c64b6c

SHA256
04635b686dd2e54130db1f0c72e5a48026e065d95855f00e0f8e6363db0cbffd

SHA512
49f2a7bb5c1ee369d604b2f01f3b7f2f19cd618f916ff7a9357ecd98c7ba2d7ba3c4c32e94c20f2c431854750effa3cc8efe3162cba68cc0673c43eb1d8ecf84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28716eba8bb413876e996ecc978012b4

SHA1
46751618580103a4fec1237abed429326444522c

SHA256
b95380f5bf14f8cc8a3a0226341cea7e7df33da3d0f6d1961a698b5c5513b911

SHA512
65b885b811a1a1261e752263e12a9037f109beb1ed625bd9c9e67169d270749764f0bba98d48052232f6b44e21a8debb39dc3e8a61e267ad9ce49e015c61afae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
892da3f73f21768cca9d4099ae84b455

SHA1
814310a32a0e6b139eedb5db3fcfb5da681b6ee4

SHA256
737504d026e5ece757c3f2fb122bbc8076510e914dd6e790d55e40982d33ac70

SHA512
54415fb1a4f7b50489fc91c65af2a8425f0526317c27e6247d4965a5e2f93663bc513f592935d8b1b406339af0336a110b54b737032fee60f5e3d102584b4e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86a9f1aeff217e8b0ee78af6d8703a30

SHA1
32f2b7eb4c6f9a252725e5a6116ffab7df021047

SHA256
228e234f88ee5b37fbf74e0c740583fbe497bbb3dc9edad3ade1624be33f0259

SHA512
a56ac343d7c27d964d26bfe4121b3a9fcb8f280663aebab7c65410051b24187c57684d8fd8f0977c88b9083a552b84a7766df9dee8d82e983c9ea2c919ecee3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8bb35ddf3730c280cc88a23806f2122

SHA1
93eeb62a9f2585ec659b8ebbeb1e0a211b51b7e0

SHA256
302e75a954751c1b8bb263c4c87f7c990dcf9d0ed4a6770bf6c4dcedbf837414

SHA512
415fdb43514a6864ee69b7912c79129e979ca020826efc5a8bcc76c5b666cbbc86537c54c2b1afe836bb61614d6bd08f5254e590b626c3e05052d4e853bdf31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4bd9bbf4da79ba79a28e6cd31e42841

SHA1
ffce02cc275d75af1be75d283ec3a5234e605841

SHA256
e11d712b71d7af93cc0ad850959bf2652d035af5738bc5a44967eea7caf448cb

SHA512
86df7cd8eb6e4f62ee595662ad2620a8677a5f8c071a4306c31bd9b8685db248da3c00bcdcb79ff9bd9bb5960b74504dd7caa268c73fe3a652538ab7a9434623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca1f8ad29f94a1ab82a64236c03ef564

SHA1
904734165db42f4850d1cc349ddbe6f2507128a3

SHA256
22f49fd36bfb4b8b942cef030ae58b97f6209f96ea2e8386641f8fefe66c28f5

SHA512
590b3ead4ff83f1f39bf41f86feca26fca11969c7ada4301321ead31de56a7f827de7ff66468ef81c6901177a8686aa8562d9d8830098271729f7494324866c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
798d1239e94b9667fb8b99646775882d

SHA1
8318803ae03663eac3138b333c6681cc9d136df4

SHA256
65ed63acea3b7f7f96803d0899bef1e77b7a0b516ccce4a848931eeaf0503356

SHA512
756f0f14c5bffb4451f0a83e8050f934a88069b5b36c09d4bd09b861b777ef07c7d6f64d22426bb803e66513531bd19ce2bbed086ccbcd37b6de1e493ea4132c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df6079c78ef3cb9824106f81b8baa63

SHA1
fd0d4067d09e6cf41296e89e36b678cf2c3a7c78

SHA256
4f1ceea328623fd6feafba59baf57ac664a4b78284062377623b57ed82a4edc7

SHA512
46acea489fb31587f4cd65205fe554e3fa84b03e5b880760f42233f31b29ca2f8e1c34b4f724171e334c2e965d7faa285d052f50ce3a1f59ca17f71e077c802e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56198c52c5c64add465c840c3e6f81a1

SHA1
a9cca849e967539c2fa68c8be12c978b51fbbf27

SHA256
060a3687cf67268ccef67899218466e6e0b2f714f08877007f43de3b67cd0231

SHA512
1fe9e63b7fd33aca7a68f06bddb427a1ffbcf3d27425595a9db8f486fc6bb0eb6716a6616bbfec52683d708f93bc95975d4a5df93fa0e53272f99da0c90e940e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B71C8A01-C892-11EF-A5CD-E699F793024F}.dat

Filesize
5KB

MD5
7b8560f161b0426545704a2e93e7be24

SHA1
c0eb5c52e70f583b25a17b3096a6b2020aa304a0

SHA256
b991b09499746d974c0948b2a1fa6d8de5e7cd73cd5315e3ed1020084c529d90

SHA512
3757e3ddae448d1b9cd1be77e628312ec0021f496777e2dc5fab4307d022d294ae77018223fc652d078919cc748e646ee1cc41a6bcc206e1d21b1d906559cb55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B723AE21-C892-11EF-A5CD-E699F793024F}.dat

Filesize
4KB

MD5
ec4c6c7700696a07a02efe3966f5b560

SHA1
b69bd945f523d79c8ab426ee060fea0c548987b7

SHA256
aa7def100ec8f255153df5bb25b85eda28508076b8aaecd76540372dd57dbd47

SHA512
7f8da8dfdc195c28ef7e41e49bc814a069ef5431fbbec6d3258063a378423f4a55a27115fc2b13a7ad0f14bc69f381e98c5c97a2d78eef20bb71916f8182fb25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EF5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FD2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\5ead7c94982171010b3df1a485a03069d2986fcde13ed8b60175c59840f1607amgr.exe

Filesize
159KB

MD5
8703c6aeb2e62da71e50db9698d91e35

SHA1
cafceda794c5b1976b46a5d39949137aba8dc9e6

SHA256
c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d

SHA512
48e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a

Download Submit
memory/2552-10-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2552-15-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2552-24-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2552-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2552-12-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2552-13-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3068-19-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3068-16-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3068-11-0x00000000006B0000-0x0000000000714000-memory.dmp

Filesize
400KB

Download
memory/3068-17-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3068-18-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3068-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3068-9-0x00000000006B0000-0x0000000000714000-memory.dmp

Filesize
400KB

Download
memory/3068-20-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download