ramnit | 667375cc2bfe7e982cac3f5885383f16cdb5c2e5919496d54222f3f75ebc243d

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
667375cc2bfe7e982cac3f5885383f16cdb5c2e5919496d54222f3f75ebc243d.dll
Size 152KB
Sample240605-3xe39sdb46
SHA256 667375cc2bfe7e982cac3f5885383f16cdb5c2e5919496d54222f3f75ebc243d
MD5 a164d48e2e8a0d2a1f40da3a07535813
SHA1 37eaa57c137b7699d3d97019757c98bf4720aeea
SHA512 a8f6d687fb6de65516e9338cd0471b63b5b527c27d820a34d354c4d2c4530b2db062dd55f4101040dab03900229f773886c3b2e6a30445ebf53a44bb10d0e76f
SSDEEP 3072:En4cV8gf2u41Z5tKlwjFcvC1XWmKVQY94hlX+El:24y8gOl2AFcvqGm8QYkl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral2/memory/388-10-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/1528-28-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/1528-27-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/388-12-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/388-9-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/388-8-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/388-7-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/388-6-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/1528-36-0x0000000000400000-0x0000000000421000-memory.dmp	UPX
behavioral2/memory/1528-37-0x0000000000400000-0x0000000000421000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
388	rundll32mgr.exe
1528	WaterMark.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/388-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1528-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1528-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/388-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/388-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/388-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/388-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/388-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/388-5-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1528-36-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1528-35-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1528-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px4CC8.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3348	1044	WerFault.exe	84

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31111076"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2238070459"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424396963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2238070459"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31111076"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2240102479"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B0EE65CD-2397-11EF-B826-F2DE30E55115} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31111076"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2240102479"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31111076"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe
1528	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	WaterMark.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4444	iexplore.exe
4444	iexplore.exe
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE
1388	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
388	rundll32mgr.exe
1528	WaterMark.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1684	2844	rundll32.exe	81
PID 2844 wrote to memory of 1684	2844	rundll32.exe	81
PID 2844 wrote to memory of 1684	2844	rundll32.exe	81
PID 1684 wrote to memory of 388	1684	rundll32.exe	82
PID 1684 wrote to memory of 388	1684	rundll32.exe	82
PID 1684 wrote to memory of 388	1684	rundll32.exe	82
PID 388 wrote to memory of 1528	388	rundll32mgr.exe	83
PID 388 wrote to memory of 1528	388	rundll32mgr.exe	83
PID 388 wrote to memory of 1528	388	rundll32mgr.exe	83
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 1044	1528	WaterMark.exe	84
PID 1528 wrote to memory of 4768	1528	WaterMark.exe	91
PID 1528 wrote to memory of 4768	1528	WaterMark.exe	91
PID 1528 wrote to memory of 4444	1528	WaterMark.exe	92
PID 1528 wrote to memory of 4444	1528	WaterMark.exe	92
PID 4444 wrote to memory of 1388	4444	iexplore.exe	93
PID 4444 wrote to memory of 1388	4444	iexplore.exe	93
PID 4444 wrote to memory of 1388	4444	iexplore.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\667375cc2bfe7e982cac3f5885383f16cdb5c2e5919496d54222f3f75ebc243d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\667375cc2bfe7e982cac3f5885383f16cdb5c2e5919496d54222f3f75ebc243d.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:1044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 208
        6⤵
        Program crash
        
        PID:3348
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:4768
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4444
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4444 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1044 -ip 1044
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 38d397c653cacc803ac689cc6dadce2f32d45de009fe47e48a2d3e2452e78937
MD5 ce6220b48abed29501775a21d6ae477f
SHA1 36bc7225bb6340d74f33827be4aec52fb34ed772
SHA512 79866ad2891e8440406b86574f1e68b7ec5eba93018609b5bccae485cc794a5cb6f5cdbc954663103151c0aba2c1d8444f651dd262427f478d9a5f45b16ee379
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 004090cd676d41767c4e916db4dabcf0c9066713076a497f1ac664aca2189b3f
MD5 fb7faf9f7b71df1517d775a3fd483ce9
SHA1 29eddff40ee74a922a222a596ab79d181c56c3bc
SHA512 7492981f1f3716c6a37891755a48059b720fc6654c0f312d40aaa1417d2f6c8eae1fab2005595dbc20f71e3f2be6d41c6b32be3d26f70695357b59d8c3d7dc52
MD5 SHA1 SHA512

Submit Download

verD0DD.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD0DD.tmp
Size 15KB
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WOBB13N1\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 59KB
SHA256 5a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
MD5 0e0f0ae845d89c22bb6385f64a6b85fd
SHA1 0f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA512 baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350
SSDEEP 768:W06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9L:0R0vxn3Pc0LCH9MtbvabUDzJYWu3BU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-16-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/388-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/388-5-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/388-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/388-9-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/388-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/388-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/388-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1044-32-0x00000000003D0000-0x00000000003D1000-memory.dmp

Download

memory/1044-31-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/1528-27-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1528-33-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/1528-34-0x0000000077182000-0x0000000077183000-memory.dmp

Download

memory/1528-36-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1528-35-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1528-37-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1528-18-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1528-26-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/1528-28-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1528-29-0x0000000077182000-0x0000000077183000-memory.dmp

Download

memory/1684-1-0x0000000010000000-0x0000000010027000-memory.dmp

Download