ramnit | 5c2c5645b8423fefc02c2fc73a0d24a0a18d3258c64a7ba39cbee1691c8f1708

Analysis

max time kernel
15s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42666e61f8c187a3e1881f9fcf99c508.dll
Size

392KB
MD5

42666e61f8c187a3e1881f9fcf99c508
SHA1

5d92eacf49b4a501190caaa2b62be404bcc56983
SHA256

5c2c5645b8423fefc02c2fc73a0d24a0a18d3258c64a7ba39cbee1691c8f1708
SHA512

c478c719e2d93eea72e462a899e4b7252e554742f563a3845da5725543789870572e72306eb9df345e4596d1a139dc7abd0e84b321edba11ece4eba8e194f9a5
SSDEEP

6144:BdSOvikWQ4/nL4+sEBC6mywRw/YgnX+I9ABFe:fikWbj5sEBCTywiKIiBFe

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 6 IoCs

pid	Process
2672	rundll32mgr.exe
2844	rundll32mgrmgr.exe
2956	WaterMark.exe
2952	WaterMark.exe
2868	WaterMarkmgr.exe
1948	WaterMark.exe

Loads dropped DLL 12 IoCs

pid	Process
2156	rundll32.exe
2156	rundll32.exe
2672	rundll32mgr.exe
2672	rundll32mgr.exe
2672	rundll32mgr.exe
2844	rundll32mgrmgr.exe
2672	rundll32mgr.exe
2844	rundll32mgrmgr.exe
2956	WaterMark.exe
2956	WaterMark.exe
2868	WaterMarkmgr.exe
2868	WaterMarkmgr.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2672-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2672-30-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2844-32-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2844-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2956-67-0x0000000000120000-0x0000000000157000-memory.dmp	upx
behavioral1/memory/2868-71-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/2956-63-0x0000000000120000-0x0000000000157000-memory.dmp	upx
behavioral1/memory/2868-82-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1948-90-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1948-99-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2956-86-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2952-115-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2956-145-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1948-156-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2672-41-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2844-34-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2844-27-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/2672-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2672-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2952-164-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1948-421-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2956-423-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2952-443-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px64FA.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px624C.tmp	rundll32mgr.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px624C.tmp	rundll32mgrmgr.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2956	WaterMark.exe
2956	WaterMark.exe
1948	WaterMark.exe
1948	WaterMark.exe
2952	WaterMark.exe
2952	WaterMark.exe
2956	WaterMark.exe
1948	WaterMark.exe
1948	WaterMark.exe
2956	WaterMark.exe
1948	WaterMark.exe
2956	WaterMark.exe
2956	WaterMark.exe
1948	WaterMark.exe
2956	WaterMark.exe
2956	WaterMark.exe
1948	WaterMark.exe
1948	WaterMark.exe
2952	WaterMark.exe
2952	WaterMark.exe
2952	WaterMark.exe
2952	WaterMark.exe
2452	svchost.exe
2952	WaterMark.exe
2952	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	WaterMark.exe
Token: SeDebugPrivilege	1948	WaterMark.exe
Token: SeDebugPrivilege	2952	WaterMark.exe
Token: SeDebugPrivilege	2452	svchost.exe
Token: SeDebugPrivilege	2368	svchost.exe

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
2672	rundll32mgr.exe
2844	rundll32mgrmgr.exe
2952	WaterMark.exe
2956	WaterMark.exe
2868	WaterMarkmgr.exe
1948	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2156	2512	rundll32.exe	16
PID 2512 wrote to memory of 2156	2512	rundll32.exe	16
PID 2512 wrote to memory of 2156	2512	rundll32.exe	16
PID 2512 wrote to memory of 2156	2512	rundll32.exe	16
PID 2512 wrote to memory of 2156	2512	rundll32.exe	16
PID 2512 wrote to memory of 2156	2512	rundll32.exe	16
PID 2512 wrote to memory of 2156	2512	rundll32.exe	16
PID 2156 wrote to memory of 2672	2156	rundll32.exe	28
PID 2156 wrote to memory of 2672	2156	rundll32.exe	28
PID 2156 wrote to memory of 2672	2156	rundll32.exe	28
PID 2156 wrote to memory of 2672	2156	rundll32.exe	28
PID 2672 wrote to memory of 2844	2672	rundll32mgr.exe	27
PID 2672 wrote to memory of 2844	2672	rundll32mgr.exe	27
PID 2672 wrote to memory of 2844	2672	rundll32mgr.exe	27
PID 2672 wrote to memory of 2844	2672	rundll32mgr.exe	27
PID 2672 wrote to memory of 2956	2672	rundll32mgr.exe	26
PID 2672 wrote to memory of 2956	2672	rundll32mgr.exe	26
PID 2672 wrote to memory of 2956	2672	rundll32mgr.exe	26
PID 2672 wrote to memory of 2956	2672	rundll32mgr.exe	26
PID 2844 wrote to memory of 2952	2844	rundll32mgrmgr.exe	25
PID 2844 wrote to memory of 2952	2844	rundll32mgrmgr.exe	25
PID 2844 wrote to memory of 2952	2844	rundll32mgrmgr.exe	25
PID 2844 wrote to memory of 2952	2844	rundll32mgrmgr.exe	25
PID 2956 wrote to memory of 2868	2956	WaterMark.exe	24
PID 2956 wrote to memory of 2868	2956	WaterMark.exe	24
PID 2956 wrote to memory of 2868	2956	WaterMark.exe	24
PID 2956 wrote to memory of 2868	2956	WaterMark.exe	24
PID 2868 wrote to memory of 1948	2868	WaterMarkmgr.exe	23
PID 2868 wrote to memory of 1948	2868	WaterMarkmgr.exe	23
PID 2868 wrote to memory of 1948	2868	WaterMarkmgr.exe	23
PID 2868 wrote to memory of 1948	2868	WaterMarkmgr.exe	23
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 2956 wrote to memory of 2920	2956	WaterMark.exe	20
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 1948 wrote to memory of 1760	1948	WaterMark.exe	21
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2952 wrote to memory of 1644	2952	WaterMark.exe	22
PID 2956 wrote to memory of 2452	2956	WaterMark.exe	38
PID 1948 wrote to memory of 1032	1948	WaterMark.exe	39
PID 2956 wrote to memory of 2452	2956	WaterMark.exe	38

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42666e61f8c187a3e1881f9fcf99c508.dll,#1
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32mgr.exe
  C:\Windows\SysWOW64\rundll32mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2672

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42666e61f8c187a3e1881f9fcf99c508.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
1⤵
PID:2920

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1760

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
1⤵
PID:1644

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1032

C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2868

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2368

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452

C:\Windows\SysWOW64\rundll32mgrmgr.exe
C:\Windows\SysWOW64\rundll32mgrmgr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:604

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:492

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:340

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-492-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1760-129-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1760-223-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1760-150-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1760-137-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1760-133-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1948-156-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1948-102-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1948-421-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1948-90-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1948-99-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2156-1-0x000000006D180000-0x000000006D1E2000-memory.dmp

Filesize
392KB

Download
memory/2156-2-0x000000006D180000-0x000000006D1E2000-memory.dmp

Filesize
392KB

Download
memory/2156-4-0x0000000000160000-0x00000000001C4000-memory.dmp

Filesize
400KB

Download
memory/2452-199-0x0000000077C00000-0x0000000077C01000-memory.dmp

Filesize
4KB

Download
memory/2672-51-0x0000000000230000-0x0000000000294000-memory.dmp

Filesize
400KB

Download
memory/2672-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-4973-0x0000000000230000-0x0000000000294000-memory.dmp

Filesize
400KB

Download
memory/2672-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-24-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2672-11-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2672-14-0x0000000000120000-0x0000000000157000-memory.dmp

Filesize
220KB

Download
memory/2672-29-0x0000000000120000-0x0000000000157000-memory.dmp

Filesize
220KB

Download
memory/2672-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2672-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2844-27-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2844-32-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2844-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2844-34-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-87-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/2868-71-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2868-88-0x0000000000700000-0x0000000000764000-memory.dmp

Filesize
400KB

Download
memory/2868-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2920-103-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2920-153-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2920-984-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2920-97-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2920-463-0x0000000077C00000-0x0000000077C01000-memory.dmp

Filesize
4KB

Download
memory/2952-443-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2952-115-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2952-164-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2956-67-0x0000000000120000-0x0000000000157000-memory.dmp

Filesize
220KB

Download
memory/2956-403-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2956-405-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2956-411-0x0000000077C00000-0x0000000077C01000-memory.dmp

Filesize
4KB

Download
memory/2956-63-0x0000000000120000-0x0000000000157000-memory.dmp

Filesize
220KB

Download
memory/2956-423-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2956-84-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2956-91-0x0000000077BFF000-0x0000000077C00000-memory.dmp

Filesize
4KB

Download
memory/2956-145-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2956-86-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2956-54-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download