ramnit | 4ec82f46f83c82b72ef98780baf08fccf8a6e246ba19061549a7db80ccbb3085

Analysis

max time kernel
93s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ec82f46f83c82b72ef98780baf08fccf8a6e246ba19061549a7db80ccbb3085.dll
Size

2.4MB
MD5

b87a2a672bc4c8a5f60df8ded889071f
SHA1

6cf6935d7b79b4827272e0284f562fb8a14403ca
SHA256

4ec82f46f83c82b72ef98780baf08fccf8a6e246ba19061549a7db80ccbb3085
SHA512

66a1e3af16ca8aa9d33cf026d5fbce4f96bbcdca2f52ea8a9ea7b3c65848f1019cb249b2f3a423b32546cf3ae4e3977af18b21ff6d050e55a623d55430dd4cc7
SSDEEP

49152:xU3U+ZYmxjpv7x4GFM/+b8dTMNh9Wr73h7NXSWEqNJO5hYTVMCRisKEbzE:xiU2YmxjpDx4Zo8dYNh9q73h7NXYkRiH

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 6 IoCs

pid	Process
2704	rundll32mgr.exe
2036	rundll32mgrmgr.exe
536	WaterMark.exe
1288	WaterMark.exe
2484	WaterMarkmgr.exe
1200	WaterMark.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2704-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2704-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2704-30-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2484-55-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/536-66-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1288-65-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2484-64-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/536-43-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/2036-32-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2704-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2704-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2704-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2704-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1288-83-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/536-82-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/536-90-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1288-89-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1200-91-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral2/memory/536-92-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxB9F9.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBA86.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxBA09.tmp	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1576	4768	WerFault.exe	82
5064	2996	WerFault.exe
1156	2992	WerFault.exe
2088	3436	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3725458872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3725615360"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{09A95E1C-C6E8-11EF-B9D5-C67090DD1599} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3729365256"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3729833836"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{09A6FC84-C6E8-11EF-B9D5-C67090DD1599} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152884"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3725458872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3725458872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{09A6D574-C6E8-11EF-B9D5-C67090DD1599} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3725458872"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152884"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31152884"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152884"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31152884"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442353513"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
536	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
536	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
1288	WaterMark.exe
1288	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
536	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
1288	WaterMark.exe
536	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
1288	WaterMark.exe
536	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
1288	WaterMark.exe
536	WaterMark.exe
536	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
1288	WaterMark.exe
536	WaterMark.exe
1288	WaterMark.exe
1288	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe
1200	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	WaterMark.exe
Token: SeDebugPrivilege	1288	WaterMark.exe
Token: SeDebugPrivilege	1200	WaterMark.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4108	iexplore.exe
1132	iexplore.exe
2876	iexplore.exe
1556	iexplore.exe
3220	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
1556	iexplore.exe
1556	iexplore.exe
4108	iexplore.exe
4108	iexplore.exe
1132	iexplore.exe
1132	iexplore.exe
3220	iexplore.exe
3220	iexplore.exe
4528	IEXPLORE.EXE
4528	IEXPLORE.EXE
3148	IEXPLORE.EXE
3148	IEXPLORE.EXE
4888	IEXPLORE.EXE
4888	IEXPLORE.EXE
4192	IEXPLORE.EXE
4192	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
3148	IEXPLORE.EXE
3148	IEXPLORE.EXE

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
2704	rundll32mgr.exe
2036	rundll32mgrmgr.exe
536	WaterMark.exe
1288	WaterMark.exe
2484	WaterMarkmgr.exe
1200	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4768	4904	rundll32.exe	82
PID 4904 wrote to memory of 4768	4904	rundll32.exe	82
PID 4904 wrote to memory of 4768	4904	rundll32.exe	82
PID 4768 wrote to memory of 2704	4768	rundll32.exe	83
PID 4768 wrote to memory of 2704	4768	rundll32.exe	83
PID 4768 wrote to memory of 2704	4768	rundll32.exe	83
PID 2704 wrote to memory of 2036	2704	rundll32mgr.exe	86
PID 2704 wrote to memory of 2036	2704	rundll32mgr.exe	86
PID 2704 wrote to memory of 2036	2704	rundll32mgr.exe	86
PID 2704 wrote to memory of 536	2704	rundll32mgr.exe	87
PID 2704 wrote to memory of 536	2704	rundll32mgr.exe	87
PID 2704 wrote to memory of 536	2704	rundll32mgr.exe	87
PID 2036 wrote to memory of 1288	2036	rundll32mgrmgr.exe	88
PID 2036 wrote to memory of 1288	2036	rundll32mgrmgr.exe	88
PID 2036 wrote to memory of 1288	2036	rundll32mgrmgr.exe	88
PID 536 wrote to memory of 2484	536	WaterMark.exe	89
PID 536 wrote to memory of 2484	536	WaterMark.exe	89
PID 536 wrote to memory of 2484	536	WaterMark.exe	89
PID 2484 wrote to memory of 1200	2484	WaterMarkmgr.exe	90
PID 2484 wrote to memory of 1200	2484	WaterMarkmgr.exe	90
PID 2484 wrote to memory of 1200	2484	WaterMarkmgr.exe	90
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 536 wrote to memory of 2992	536	WaterMark.exe	91
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1288 wrote to memory of 2996	1288	WaterMark.exe	92
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 1200 wrote to memory of 3436	1200	WaterMark.exe	93
PID 536 wrote to memory of 1132	536	WaterMark.exe	101
PID 536 wrote to memory of 1132	536	WaterMark.exe	101
PID 1288 wrote to memory of 1556	1288	WaterMark.exe	102
PID 1288 wrote to memory of 1556	1288	WaterMark.exe	102
PID 536 wrote to memory of 4108	536	WaterMark.exe	103
PID 536 wrote to memory of 4108	536	WaterMark.exe	103
PID 1288 wrote to memory of 2876	1288	WaterMark.exe	104
PID 1288 wrote to memory of 2876	1288	WaterMark.exe	104
PID 1200 wrote to memory of 3220	1200	WaterMark.exe	105
PID 1200 wrote to memory of 3220	1200	WaterMark.exe	105
PID 1200 wrote to memory of 3236	1200	WaterMark.exe	106
PID 1200 wrote to memory of 3236	1200	WaterMark.exe	106
PID 2876 wrote to memory of 4888	2876	iexplore.exe	107
PID 2876 wrote to memory of 4888	2876	iexplore.exe	107
PID 2876 wrote to memory of 4888	2876	iexplore.exe	107
PID 1556 wrote to memory of 4192	1556	iexplore.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ec82f46f83c82b72ef98780baf08fccf8a6e246ba19061549a7db80ccbb3085.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ec82f46f83c82b72ef98780baf08fccf8a6e246ba19061549a7db80ccbb3085.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 208
        7⤵
        Program crash
        
        PID:5064
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4192
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4888
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        7⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 204
        8⤵
        Program crash
        
        PID:2088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3220
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3220 CREDAT:17410 /prefetch:2
        8⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        Modifies Internet Explorer settings
        
        PID:3236
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:2992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 204
        6⤵
        Program crash
        
        PID:1156
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1132
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3148
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4108
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4108 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 624
    3⤵
    - Program crash
    PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2992 -ip 2992
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2996 -ip 2996
1⤵
PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3436 -ip 3436
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe

Filesize
115KB

MD5
42772a782bb1c6444f6e4d4b5c51bed9

SHA1
57663c9f055ffc52d46b4dd2a91ffa8c191be33b

SHA256
aac7bc007ae051fb71fb735ad4e92a6be8ec48ade1a3bf3b40746949a4dfd125

SHA512
cb7cd3b5f18f1834b6eccf5be5858614b154ae8d146aa746dddc74bea14c7daf4a7833d3a9ed4f0d32c9821d85901f74a367a830d3b7f0bf379fa1fdd5fae6cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
e5e877bcc2542ab8629d8f34bafcd7f4

SHA1
8f618efa1584268e9eafd2b01c2a2ac006113c01

SHA256
5e63bcec102963b96b1f7d08ec512431a0ba748f90134dc51a05046296541e9e

SHA512
79153f941ae2cc4a5649ac729f03dd3f98df24d5084e36d14467b2a859e6d63fc4167feac24e7b519a9e179fb243447fe6d09519169b11e3151d5cc467e4c9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
811129b50e075b863335f2b51fb5d8a9

SHA1
7c6dad0b1be2120331829c040508b59618c27392

SHA256
fdaec3674aeee830d4f24dc330de2729cf5ebfabcca6ed10b5fd6b88f8036b84

SHA512
a6d1ee7d027dae9929fe33008773e8f6fd6e78b1593e7bd90e13199107f4bb17a232946c7fd406f1c7b1151c1d6d5b85a711c932ebacb1105035435d84c48e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
10b1f962dfdd663bcec3f04de53c6214

SHA1
c4c58105112e3e4730abba0a93bade86b538b403

SHA256
6abba442b2395cdc24a617910d547f2421317cb14570a2ff205e5d8760d4b368

SHA512
79c7b2edd97f633e22d6fa72dc39d06a1c1d96af45bced6fbb9111f6d74956bbafaf0c3e4ee39f5ce45cdc2e979a47706ecfa92627125784a7e9f28a5b928fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
e839e5391fcf9c5c535123ab44290916

SHA1
e6ce5624df4da90066f63c831158d627cb36e1e4

SHA256
6b63546044c71f9f7a2222ce7ed9f297e87cc9895ed3dd3253f10186665775c9

SHA512
9ef77dad7c3de0516d2e67fce3ca0c2d19346e7bd9b3a2d59af402e492eaf5580963183a574a77eb475b7cdcc563ab38f5c5791536ce775f05fa5725c9445151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
3ef28b26d8abb95e9f6d0b051b16db62

SHA1
c8723e789dbfd6186d864f765ff87fde22528e54

SHA256
f870f1fb11cc281357dec3f8273a7f3175d0c175f110e4a6ef6aeaf4c97ff19c

SHA512
46455c66684c3a0fc94eb50a8e158957ba6fb7b619d8e145d9f32424d7cb9fb78a723489c3f3e78964e3eebbd49c896d5b13ed339a255bb71a1a90f51772fbd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{09A6D574-C6E8-11EF-B9D5-C67090DD1599}.dat

Filesize
3KB

MD5
0ef5cfc8b85a5b793a5d13704b7c7ed5

SHA1
188348b4ba252e8c0a95f0fbcd5c2ed427571742

SHA256
c452006511a91380d9ec8aee88cdc295d2e63b6ca55739a23ccb7738f52df08f

SHA512
8f82b87b6c17ca307c7f74b03a1cd46d400b6a67b50fe3b05804145ccb03516b8e342b936b2632e0ba5afd5753fddb15cba491d478288147dd2fe1af6007dea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{09A6D574-C6E8-11EF-B9D5-C67090DD1599}.dat

Filesize
5KB

MD5
7d11d0f5b4eee084dfa450ba38ab598d

SHA1
6e45cbfe197017b9b7476c0b15e4054b3c0cbd0e

SHA256
e1aa455518e4017dc99ef8aa5afc6cef081f451f4fb3b4fec71b7ae688a5c3f0

SHA512
bcacdca267206a74a3d03a2d97af980c63a44b8b80b7e0802a9e3e932c5145c76b2f2c79be917678aba730ce22ece1725a84e9671e781424eac2cb9fd68d5249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{09A6FC84-C6E8-11EF-B9D5-C67090DD1599}.dat

Filesize
3KB

MD5
778438769f881078d139acd69b86a47a

SHA1
f3e9fb62e7d38d15863416677d74901f888365c8

SHA256
280a6751452031d0bb55bafe275270cdda6551878d8b7b03ee495715c493d8fd

SHA512
b08db2846d365b2d4a6c6aeccb5ab5616651641a63cf87d475dd17e3a52195c2662f27de440be3f5db76774fd4508e64a809f771e905565c34e61fd410fa9337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{09A6FC84-C6E8-11EF-B9D5-C67090DD1599}.dat

Filesize
5KB

MD5
9481eb26577ef3bdc4a81664fcbdbb90

SHA1
da54269cd29951b5b35e0672e139e61ea1be3d4f

SHA256
e51acd1b82c5a146a4bde4d221a3059a473c9040e071ca2f981515e9d0d1d620

SHA512
a9b3e1b3b3bf3b5b99189e5eb27cc5ced3edeadec79ad186915c2349017b69be6961e955694c28b61c31448dfe1378fc065cec8e4f67021f16bf80382d2e32fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{09A95E1C-C6E8-11EF-B9D5-C67090DD1599}.dat

Filesize
3KB

MD5
93dc71dc758ae38eb71f568152f9d4be

SHA1
48974b6b95f3435f3af70c8db9793f58d67ec2ef

SHA256
83c39b6045948b83cd12299c1d7023487c8b92f2e1d83456663bf7d7eaff13e9

SHA512
1dd3f6b94f4d1b2e2b748c6c46a87e15ba68d9687c054f53f2113c1dc98cac84eab31fc6a94767e63383abe92717363aa02f76e9bb6791f0fcf1255b39babe49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3CE5.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
233KB

MD5
7816267b885055210f56ea4fa2b6df2a

SHA1
9dffc3317e685cc65f3d458799ca7c36e4966a09

SHA256
bcd868b32cb2e9954cbca19e2348653fa9cd5ad52b933c9a871dca6341733311

SHA512
14c9d98ef827a5df6d99f4678d392da634a7200997b775f713d6f418f32ce2ae01197a6ef9003b6a52e11a539e32402edd9a9129a330523ae4b8d78f423050dc

Download Submit
memory/536-79-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/536-43-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/536-90-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-61-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/536-92-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/536-82-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1200-91-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1200-70-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1288-62-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/1288-83-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1288-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1288-48-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1288-89-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2036-17-0x0000000000404000-0x0000000000406000-memory.dmp

Filesize
8KB

Download
memory/2036-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2036-32-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2484-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2484-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-16-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2704-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2704-5-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4768-0-0x0000000008000000-0x0000000008276000-memory.dmp

Filesize
2.5MB

Download
memory/4768-78-0x0000000008000000-0x0000000008276000-memory.dmp

Filesize
2.5MB

Download