gh0strat | c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Analysis

max time kernel
1800s
max time network
1799s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07-12-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

smss.exe
Size

260KB
MD5

27fe3482f2f12435310a3c84544f4f0b
SHA1

dcef2cd3c551bf22b748556d7cdcd439a6cc5274
SHA256

20105bd3112e1467d5081400343a6c4baa915c12012db77fadddd5a84e7a0b75
SHA512

2324d9e10f410c3573d99dcdf3daf0960965e0e09a5134d21ad25e9cf6d0f91919e38cf37513b27baa25c3ade79825096dd88c50dfa5ddb82ff8ed36c32b2c48
SSDEEP

6144:AVx3d4gxU0UqWTYFa6u+CaTy8ZcILWlxwbtEW3kT4:An3S90y8aX+/RciixwbtkT

Score

10^/10

gh0strat ramnit banker discovery evasion rat spyware stealer trojan upx worm

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral22/memory/2480-0-0x0000000000400000-0x0000000000442000-memory.dmp	family_gh0strat
behavioral22/memory/2480-8-0x0000000000400000-0x0000000000442000-memory.dmp	family_gh0strat
behavioral22/memory/2480-12-0x0000000000400000-0x0000000000442000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	smss.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\smss.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smss.exe:*:enabled:@shell32.dll,-1"	smss.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	smss.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	smss.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
3096	smssSrv.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	smss.exe
File opened (read-only)	\??\X:	smss.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\E:	smss.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\Q:	smss.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\I:	smss.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\S:	smss.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\O:	smss.exe
File opened (read-only)	\??\R:	smss.exe
File opened (read-only)	\??\W:	smss.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral22/files/0x001c00000002aa59-3.dat	upx
behavioral22/memory/3096-6-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral22/memory/3096-4-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	3096	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smssSrv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2480	smss.exe
2480	smss.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe
2480	smss.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2480	smss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3096	2480	smss.exe	77
PID 2480 wrote to memory of 3096	2480	smss.exe	77
PID 2480 wrote to memory of 3096	2480	smss.exe	77
PID 2480 wrote to memory of 640	2480	smss.exe	5
PID 2480 wrote to memory of 640	2480	smss.exe	5
PID 2480 wrote to memory of 640	2480	smss.exe	5
PID 2480 wrote to memory of 640	2480	smss.exe	5
PID 2480 wrote to memory of 640	2480	smss.exe	5
PID 2480 wrote to memory of 640	2480	smss.exe	5
PID 2480 wrote to memory of 696	2480	smss.exe	7
PID 2480 wrote to memory of 696	2480	smss.exe	7
PID 2480 wrote to memory of 696	2480	smss.exe	7
PID 2480 wrote to memory of 696	2480	smss.exe	7
PID 2480 wrote to memory of 696	2480	smss.exe	7
PID 2480 wrote to memory of 696	2480	smss.exe	7
PID 2480 wrote to memory of 808	2480	smss.exe	8
PID 2480 wrote to memory of 808	2480	smss.exe	8
PID 2480 wrote to memory of 808	2480	smss.exe	8
PID 2480 wrote to memory of 808	2480	smss.exe	8
PID 2480 wrote to memory of 808	2480	smss.exe	8
PID 2480 wrote to memory of 808	2480	smss.exe	8
PID 2480 wrote to memory of 820	2480	smss.exe	9
PID 2480 wrote to memory of 820	2480	smss.exe	9
PID 2480 wrote to memory of 820	2480	smss.exe	9
PID 2480 wrote to memory of 820	2480	smss.exe	9
PID 2480 wrote to memory of 820	2480	smss.exe	9
PID 2480 wrote to memory of 820	2480	smss.exe	9
PID 2480 wrote to memory of 828	2480	smss.exe	10
PID 2480 wrote to memory of 828	2480	smss.exe	10
PID 2480 wrote to memory of 828	2480	smss.exe	10
PID 2480 wrote to memory of 828	2480	smss.exe	10
PID 2480 wrote to memory of 828	2480	smss.exe	10
PID 2480 wrote to memory of 828	2480	smss.exe	10
PID 2480 wrote to memory of 940	2480	smss.exe	11
PID 2480 wrote to memory of 940	2480	smss.exe	11
PID 2480 wrote to memory of 940	2480	smss.exe	11
PID 2480 wrote to memory of 940	2480	smss.exe	11
PID 2480 wrote to memory of 940	2480	smss.exe	11
PID 2480 wrote to memory of 940	2480	smss.exe	11
PID 2480 wrote to memory of 1000	2480	smss.exe	12
PID 2480 wrote to memory of 1000	2480	smss.exe	12
PID 2480 wrote to memory of 1000	2480	smss.exe	12
PID 2480 wrote to memory of 1000	2480	smss.exe	12
PID 2480 wrote to memory of 1000	2480	smss.exe	12
PID 2480 wrote to memory of 1000	2480	smss.exe	12
PID 2480 wrote to memory of 472	2480	smss.exe	13
PID 2480 wrote to memory of 472	2480	smss.exe	13
PID 2480 wrote to memory of 472	2480	smss.exe	13
PID 2480 wrote to memory of 472	2480	smss.exe	13
PID 2480 wrote to memory of 472	2480	smss.exe	13
PID 2480 wrote to memory of 472	2480	smss.exe	13
PID 2480 wrote to memory of 460	2480	smss.exe	14
PID 2480 wrote to memory of 460	2480	smss.exe	14
PID 2480 wrote to memory of 460	2480	smss.exe	14
PID 2480 wrote to memory of 460	2480	smss.exe	14
PID 2480 wrote to memory of 460	2480	smss.exe	14
PID 2480 wrote to memory of 460	2480	smss.exe	14
PID 2480 wrote to memory of 1052	2480	smss.exe	15
PID 2480 wrote to memory of 1052	2480	smss.exe	15
PID 2480 wrote to memory of 1052	2480	smss.exe	15
PID 2480 wrote to memory of 1052	2480	smss.exe	15
PID 2480 wrote to memory of 1052	2480	smss.exe	15
PID 2480 wrote to memory of 1052	2480	smss.exe	15
PID 2480 wrote to memory of 1068	2480	smss.exe	16

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:828
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:472

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:808
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2924
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
  2⤵
  PID:3716
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3744
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3836
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3900
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3920
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
  2⤵
  PID:4240
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2984
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3280

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2056

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2516

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3016

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3300
- C:\Users\Admin\AppData\Local\Temp\smss.exe
  "C:\Users\Admin\AppData\Local\Temp\smss.exe"
  2⤵
  - Modifies firewall policy service
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\smssSrv.exe
    C:\Users\Admin\AppData\Local\Temp\smssSrv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 320
      4⤵
      Program crash
      PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3460

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 3096
  2⤵
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\smssSrv.exe

Filesize
84KB

MD5
5cdc5ad14f0f7476711d2ab65607fe5b

SHA1
d03fa4a202afc929725f969471a8c1d5943fd12a

SHA256
4e7d57da4995611e1451846e7a08017a4fbca09215a31707d6ac2957b71f5a97

SHA512
b0a0c1367efcd37c827306ca5ebad1cd6fca695d12746df1686a3f9ee1d59698ef82ba98b5e697f311168a63533d7046729eae921ce177213183253ea815a9a2

Download Submit
memory/2480-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-7-0x000000007FE70000-0x000000007FE7C000-memory.dmp

Filesize
48KB

Download
memory/2480-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-10-0x000000007FE70000-0x000000007FE7C000-memory.dmp

Filesize
48KB

Download
memory/2480-9-0x000000007FE70000-0x000000007FE7C000-memory.dmp

Filesize
48KB

Download
memory/2480-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-25-0x000000007FE70000-0x000000007FE7C000-memory.dmp

Filesize
48KB

Download
memory/3096-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3096-5-0x0000000002010000-0x000000000201F000-memory.dmp

Filesize
60KB

Download
memory/3096-4-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download