ramnit | 3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34

Analysis

max time kernel
144s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe
Size

8.0MB
MD5

27038a95bd4709a40755ae920e606b03
SHA1

6c5586ff2404b8ea37e5b3ac8ead7b778a6f2d9a
SHA256

3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34
SHA512

bc108a0f98ab58e77dced11492e880a36ea3578c2c910c759e557a9bae4ff309df2f4b477ce9c8d88d3d3b760ab870a38faf072b61294c79d815fb3e5856fa64
SSDEEP

49152:dc75uCs+mC5d9CjZPl+jD63UxrWvNE+XJmJO5byML3GtHsEO+rTBtAYc1wxWRmri:dc77HBAdZN1fyMWzYZ/XOr

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 4 IoCs

pid	Process
1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
2740	DesktopLayer.exe
2840	DesktopLayerSrv.exe

Loads dropped DLL 4 IoCs

pid	Process
2680	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe
1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
2740	DesktopLayer.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a0000000120d6-1.dat	upx
behavioral1/files/0x0009000000015689-6.dat	upx
behavioral1/memory/2840-39-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2740-34-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1808-27-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1808-18-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1772-12-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px9CFB.tmp	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px9D29.tmp	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe	DesktopLayer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px9D68.tmp	DesktopLayerSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	DesktopLayerSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayerSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443087433"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CD2E011-D311-11EF-875C-F2BBDB1F0DCB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CD07EB1-D311-11EF-875C-F2BBDB1F0DCB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
2740	DesktopLayer.exe
2740	DesktopLayer.exe
2740	DesktopLayer.exe
2740	DesktopLayer.exe
2840	DesktopLayerSrv.exe
2840	DesktopLayerSrv.exe
2840	DesktopLayerSrv.exe
2840	DesktopLayerSrv.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2704	iexplore.exe
2556	iexplore.exe
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2680	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe
2680	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe
2704	iexplore.exe
2704	iexplore.exe
2880	iexplore.exe
2880	iexplore.exe
2556	iexplore.exe
2556	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1772	2680	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe	30
PID 2680 wrote to memory of 1772	2680	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe	30
PID 2680 wrote to memory of 1772	2680	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe	30
PID 2680 wrote to memory of 1772	2680	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe	30
PID 1772 wrote to memory of 1808	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	31
PID 1772 wrote to memory of 1808	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	31
PID 1772 wrote to memory of 1808	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	31
PID 1772 wrote to memory of 1808	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	31
PID 1772 wrote to memory of 2740	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	33
PID 1772 wrote to memory of 2740	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	33
PID 1772 wrote to memory of 2740	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	33
PID 1772 wrote to memory of 2740	1772	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe	33
PID 1808 wrote to memory of 2556	1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe	32
PID 1808 wrote to memory of 2556	1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe	32
PID 1808 wrote to memory of 2556	1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe	32
PID 1808 wrote to memory of 2556	1808	3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe	32
PID 2740 wrote to memory of 2840	2740	DesktopLayer.exe	34
PID 2740 wrote to memory of 2840	2740	DesktopLayer.exe	34
PID 2740 wrote to memory of 2840	2740	DesktopLayer.exe	34
PID 2740 wrote to memory of 2840	2740	DesktopLayer.exe	34
PID 2740 wrote to memory of 2704	2740	DesktopLayer.exe	35
PID 2740 wrote to memory of 2704	2740	DesktopLayer.exe	35
PID 2740 wrote to memory of 2704	2740	DesktopLayer.exe	35
PID 2740 wrote to memory of 2704	2740	DesktopLayer.exe	35
PID 2840 wrote to memory of 2880	2840	DesktopLayerSrv.exe	36
PID 2840 wrote to memory of 2880	2840	DesktopLayerSrv.exe	36
PID 2840 wrote to memory of 2880	2840	DesktopLayerSrv.exe	36
PID 2840 wrote to memory of 2880	2840	DesktopLayerSrv.exe	36
PID 2704 wrote to memory of 1720	2704	iexplore.exe	37
PID 2704 wrote to memory of 1720	2704	iexplore.exe	37
PID 2704 wrote to memory of 1720	2704	iexplore.exe	37
PID 2704 wrote to memory of 1720	2704	iexplore.exe	37
PID 2880 wrote to memory of 2184	2880	iexplore.exe	38
PID 2880 wrote to memory of 2184	2880	iexplore.exe	38
PID 2880 wrote to memory of 2184	2880	iexplore.exe	38
PID 2880 wrote to memory of 2184	2880	iexplore.exe	38
PID 2556 wrote to memory of 2008	2556	iexplore.exe	39
PID 2556 wrote to memory of 2008	2556	iexplore.exe	39
PID 2556 wrote to memory of 2008	2556	iexplore.exe	39
PID 2556 wrote to memory of 2008	2556	iexplore.exe	39

C:\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe
"C:\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
  C:\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
    C:\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2008
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2880
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2184
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3cf7d1517a32309ec4d7213151a66d1

SHA1
f999d12811da6683d927cc41447aa5f89d928910

SHA256
b4100ac9b3bad81208966c67d16f6c20439084f2936f7784919f3f7c8d29307d

SHA512
b8c0e1a7382c3aaa162f24674adfb4738fea98a209ec459ad8ee413664264c7553abbb8ddceb4e7960faa8daa79703494745edd2cc989bcf27fa47773cbf37ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
609a7a35b5abf7f0e91c2d3267286e47

SHA1
2231d13c4f6b2ac48f91265a0bf585250b04e582

SHA256
e9a2270be048fe8992b78bfd01737e6ddaf6b06a4dcdcebd8db6cd0ad1d6e439

SHA512
674e3c7c602b9a156c217aed8a875c5b278f3b4464dcf78331286de1de49a53bfbde395f6e4b00132d22cdaab49407548fba5245999bf6af70960f1d27653426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
865de55f6186aa3518c365e5f291e845

SHA1
5d203990edec2522145834b9931840c01d83bb88

SHA256
8e14e704ed858005938b6615e53bda2700a06fa0cbb8069fe5b83de941515125

SHA512
7fe8d38af4e2a1651eb38738973a2489870927fed41ed56b46f94e59c0fb5cd54f5b62bab3e477d0b3a1b4d983ada7879d4a0d98673ff154783c8676e13bf134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a13b3f48e6958d641bff26786029a0b2

SHA1
a4ea1f698be436db5086821db1146debe3ae7873

SHA256
0295f203ecceb1e27dd603ffcee39e41a30f63e938050e14a21caaeaa43ee4c7

SHA512
3b3faeee22f4953c98fb197c06cb40873cbbda4098558810aa249dfdaa777b9213dd9cf6fa913e3ddf1fe0ee8102872360b59ce4e67ba2b121f9d10cfcfb0663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f86c067238099a338edb4cc50bd1c414

SHA1
2f2c5bbeecb4429fbca8b5f274eba0cafe8edeaa

SHA256
12b8e0084166619ce57b1c3ac6aac88262c99ca06f3cd64dab054664f5262360

SHA512
2f722726d54c7391ccef311c78f16ba51a4582c0bac172ba2dcd6ef0b5f687e909f0948e28caf25df644d3954e058b381b5150e8f526563d25cc3ccf0f94a22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
718b544669486108d25068baff2b591d

SHA1
2614e958a00211e3c2453420012dc4283e89f8fb

SHA256
d01119016b1f68857cfee19fdcc4309d618ed52955fe69902db8d3c9c29a4bf9

SHA512
b6555051c6e0adf8a79e5e0db1653b7252ab67fe74e748b5128ebe968626ca3c42ab0a13633347755502efe81e6d57ae57e657433ba83970204c79ecf166bb77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6a23bdaabf967c6cc2d00f9f8bbaee4

SHA1
d1c963c8f20ca90402a3480612aef5ac3b023a0e

SHA256
dc880c9a101919e1637df8fa32f7d322b39b7d21aea98caecd5fc0d702a3e4ee

SHA512
69f7c99031276fc178e5e4ad35b96e7525ad5b4c074cbbb77b590b506b55e38a3058e39f72de2169f71fa48d27d44833151892cb93358c84216661da3e85f9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
543c941c81e84e25db187d187adc5d73

SHA1
d73de60af35cc49177c32907272e48502715a1a0

SHA256
66cf1f8dc58fd5de0d97ae9be6cf4151f5ad8d539557ee03e65fe5ca546ca467

SHA512
9fa07df4fd3429a74a2ce3a25e104a64733264ad122278dd032e180b5c07acbd4a3557d1d357859841bc4a3814f333497d89fda24124cffb7924fc1b8a7459f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ad94fe309ed1a15739a2000e389744a

SHA1
2a7160324e975371b5879b7639a52e9936d8f316

SHA256
a08483c41e01a96200d5e22a115fb77cba8ca99cce2a5f4301260c1e2cefbf2a

SHA512
7671dad6a8a02002d50fd009fbd768c3281fdcf558d4480b333719228f30ddaa12ffbb9acd9416de030408c6870114e2903def5dd84f992a64d8817408194a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed62a7d27e4f520c3733adce7e0941e7

SHA1
2194570e6d8c794cca982f4f6cfaca4b2c20ffac

SHA256
9246577970160d1d014a859d878af34348805b55b9251788a71e244cac6589df

SHA512
14d89df0971dbc0db358a3d8063958d16ada882af8477bcc63af80891ed3a897b17802d90a3ff8959458aa44504fb818f2e04861ced08ad947b2b015375e3f13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d9c8f8241d94ebe41e859e20f208653

SHA1
a54c77368bcca9d92dd0ebc59ac0c7484d1f01c8

SHA256
d9f4492756c218bf9656280ff5eceb2142c5a449cb95fd4c1e1ea1d4b4c8428d

SHA512
ce228a8c4dc80ddb1df705d154f7739851c6ab0d62f027ea8c2c54221d2f2ddfaf01214be8e512cc9edef34bba6b190936fb9aec84ed35030a2e03308cb946c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13d0b4c8f8a064713e09554c2aebf404

SHA1
72ed0b8e24a4bb62b6b44c7d12656d4ed4b78012

SHA256
158fe9d825c7752f35b5be920b0a85acea50944547f1063154b3715a5368ac15

SHA512
8f42eb436e61bf9ca01ad32e5ad3d3ea9777d20349af001d65ece0010b5bb842d8d19a4189a20960377ff444b14549ab635d25ac4e5c5e198ffa566e0c0cd658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b58ecba779343c27dc1b3989aab2587b

SHA1
a7e0f77a79733facc80c6721b0941fc37670674f

SHA256
270be84c65a52fcb48a8c1969b987a44e4fd317e31230adf363dc03b886b7a21

SHA512
8b66519da9e98bf193ed1990ae5e87ebb47da2e71118f96785f092dfdf4c3fafa46c6c6408cb7f3fa43b8f5c21a750ffdd36bfa45eb1070f81b5c42e6eb7489e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd6241168cca82399cf3c521223f2d3b

SHA1
5bb8967b10216376bf465ea1c4b319668f13b44e

SHA256
056d8ecc3a39e1e140ece8427e318d9f7c8cd756a207ab8e880d849f0e55dc6e

SHA512
bb67b871d91f5b1793fdfc7de42d45566103fe9e5f898009bbade54ef0edc767ca7ea1fedce8b6ab856b054e6ddc9f29c1f977f3248ea393715f2122f5ac401d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d6ff47eaad686a91ca5b75f46a7ec84

SHA1
de3d03be6ea8b8ac1dfb606299e84c404268757c

SHA256
49f4435761b102e915293700ea79ee1f978524b30c6a763a9dbcf8541b56a7bd

SHA512
b180eddf650e1461f850aa5663fede08046e0f113b07a6ec43452f19517fb6f89a2ad37bad3c8438c0fd4b49e0d092f0fa8b504b18ab1c5b088718be1b6ee079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcdfc16d75929ad5a33bf9e2833cd10a

SHA1
d06521108e883634b340ad53d91de898470f955a

SHA256
f9e8738dc4da20c38fefde6950f96e6fb0af7f81b79a3b0d3676e2edaf57e382

SHA512
6c164457cf36293fb9a138089c1fff05bea86c457a671fada05917437d943a50acaa4622b4470417e5b3dc7964c2e645f226806e3e0b3e1328bae63c78e9035d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6604e9afc486a3585b3f3e1061bb48c

SHA1
77f8e720a399a250b0e6bd824825697a0b19a20b

SHA256
8334cd2b9633b06564740147bdbd1a8c19603f9809987d82eb1299624957a71d

SHA512
6f42b8c9cb61038d709348eeb1daed5a8fdba8dd06f83664275f151b27f32fbf23cd478817be00a66e4f97f7105258cc329651caad734f928aa3ed4d00b90940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3791a682130c76660d4ae6db8b91fac3

SHA1
f1f8cb1936f2daa31daf94a78b0cc72f7e76883a

SHA256
6cba3802147edefd545a314829ac8c1826b64015de223a98d8271fd7ffd6b0f7

SHA512
e362246399773eff729b05dcfd51ebf092c769bc3b242b7840942725dd3e5dded7d118156c6af78049f0db60a42bcf291f91e8414f39d10b2287919923015fd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85d6a9b0260bb618f098a9f997df7630

SHA1
41ddc2acad69ab1226658f884555e37288790721

SHA256
9104cf14df4a0dfdb3820b65dfbad0030e88a3b5891059122fcd6256a2f2d75b

SHA512
42de65a58d195762ce75b743ead03a5177959412a5ceca5f4320d00760cb333ef6736e35277854b73ada1b196a0bea788bbf95cc75978e78203cb28f29e4666a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfac6853e11aef9c3dd088eed05b7003

SHA1
1ffc06521a5db8ce52c7a81fc4a30fde79a5691b

SHA256
ed96957407bd126c282f14a69ef9869302712f3d66dfb7074431e5c04965293f

SHA512
6661e228c869d643c11c52c85cac0d39adb83460784f8039204240af5e31fe7e99375ff6c7ee849bc4eac0f764a105153f0492972b80e65405c5b3f0de90140f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8042a404d13262bed63a77bc19daed7e

SHA1
42fbc8e3d2cac35dea73b7bb7e6d94934df4c213

SHA256
e7868f1e2bcc77c9fc30945b2b7054109d77580ebff67f7a999a4e0c8b411e45

SHA512
8860d85bb69976b9d416f2fb73edae24970d1af1622a716d472f2f2912d23ac80cf3682d0df8211244ea0e98156bc08aa5b5bc216d596adfa48497da17895ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e419f407b69aa5b1af5d7eaf78f0867

SHA1
10a5e3a3adc509a6f000e7f06323bbdbc96789f6

SHA256
8fa8f65e54c91ea1f40dc7a404c2135dca523a3215c0d3d38dab6954c2f8cd29

SHA512
467fe0bf1ba36517ee4d51a8340c45d3e0d98b79d1c45eb46621ba26ee91f2697399b3f8e0bfb95c89f686682ef08cbefa07cfbcfa122e34687a1010f906f611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0CD2E011-D311-11EF-875C-F2BBDB1F0DCB}.dat

Filesize
4KB

MD5
ca00e0d58264ff147cc913fb8de9455b

SHA1
ffcd6cb4b930ad4362fca62a9f6ff23aa665da56

SHA256
8da0a9f7f7be81ad8bd05350ac66056be15290961ecadaf612f3ed14783f2860

SHA512
2fb3eadc8657a8d1c108907d4924b382f694831043825e110b134b3571e255f5236e233b417dd538c876ba7064e09b1910ebfa7146a7e4faeca71be9aa352e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0CD2E011-D311-11EF-875C-F2BBDB1F0DCB}.dat

Filesize
3KB

MD5
77636050eb750d5bbb61294a9e900599

SHA1
8ad7b8c874bd5086684cc59bbf2c4af4093ec5c4

SHA256
a16abe8c9f8427e0539e6453ce4fb5ad73ba81615eecc67758b3b0fda3a802cd

SHA512
0c96afebddb9571e86e721c80f140cb90b8a0d16c7eabf789713581818b22b3991f50179bb83e17958fc74c82e6f0ae07f51e367306f6a4276bb154259c90767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0CD7A2D1-D311-11EF-875C-F2BBDB1F0DCB}.dat

Filesize
5KB

MD5
f138fe547b459129d6ea67e0a2f6a5e5

SHA1
001ad6c8012cca2596dcacc0e2bca8fc0d01caff

SHA256
c35fc9d0e94292c873708fb3e9d848e50e158f078277b77c3ee1362cb68669ac

SHA512
2aff7098ec2c253b062b118a068f96454e4b23518d654fa17b225c2540e7c15dfb1448d97ad0f17c53baf7f9ddfeb8ca709de5827d0709b3ee27ad9cd898643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF1E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF8E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34Srv.exe

Filesize
111KB

MD5
ccc937bcd06f7bfa99abbdf16d4af87b

SHA1
22c08152fa73d1d055919283604fcf4685ba0e9a

SHA256
6841eefc56ca10ac8b40a71b23f471fa4fc36d71f19fb0bbfe548035f9cdab27

SHA512
875e2cdf0d158e00684d6a30b4adebb7f18c6f2918fa2328eddae173193cabe111badb72ce354cec223b409d713356854bf6125103bb06bd0496d9e615095d4b

Download Submit
\Users\Admin\AppData\Local\Temp\3ac11012aae6ee127b637a5cab667fff70d54d7ff31a7beb998e65340e5fba34SrvSrv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1772-14-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/1772-13-0x00000000002D0000-0x00000000002FE000-memory.dmp

Filesize
184KB

Download
memory/1772-12-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1808-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1808-19-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1808-18-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2680-17-0x0000000000290000-0x00000000002CD000-memory.dmp

Filesize
244KB

Download
memory/2680-43-0x0000000000F50000-0x0000000001759000-memory.dmp

Filesize
8.0MB

Download
memory/2680-11-0x0000000000F50000-0x0000000001759000-memory.dmp

Filesize
8.0MB

Download
memory/2740-34-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2840-39-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-37-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download