ramnit | d2b2f8da6b60ca6991b91dc993374f2e294967d0aa926017a5cfec6aa344014f

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe
Size

288KB
MD5

ad02bd63c55b08e4f74e2eaeceb3795a
SHA1

e24afbbc3f21e92a5a8c1113697c1029c2f65f04
SHA256

d2b2f8da6b60ca6991b91dc993374f2e294967d0aa926017a5cfec6aa344014f
SHA512

9dc158995311391261d47084e6d87cab6480f646755c07b1048416ab00c6511bf8a0ebf4abd8f89bb8433424796c8d7a1b7c4aebdc9abcb421cf83d637e7f447
SSDEEP

3072:/eAQAqT8OTi+iRSrpF/FWwNYuznxMmEsSbUN0R+OpN/iPqmT9:m3T8Z+iR4Z9uuzxhE9sdO3/YT9

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe
2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000012281-2.dat	upx
behavioral1/memory/2132-10-0x0000000000400000-0x0000000000481000-memory.dmp	upx
behavioral1/memory/2132-15-0x0000000000400000-0x0000000000481000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\HELPPANE.EXE	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	helppane.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe

Suspicious behavior: MapViewOfSection 25 IoCs

pid	Process
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
Token: SeDebugPrivilege	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
Token: SeTakeOwnershipPrivilege	2644	helppane.exe
Token: SeTakeOwnershipPrivilege	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe
Token: SeRestorePrivilege	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe
Token: SeBackupPrivilege	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2644	helppane.exe
Token: SeTakeOwnershipPrivilege	2644	helppane.exe
Token: SeTakeOwnershipPrivilege	2644	helppane.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	helppane.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	helppane.exe
2644	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2132	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2132	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2132	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe	30
PID 2976 wrote to memory of 2132	2976	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe	30
PID 2132 wrote to memory of 384	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	3
PID 2132 wrote to memory of 384	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	3
PID 2132 wrote to memory of 384	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	3
PID 2132 wrote to memory of 384	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	3
PID 2132 wrote to memory of 384	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	3
PID 2132 wrote to memory of 384	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	3
PID 2132 wrote to memory of 384	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	3
PID 2132 wrote to memory of 396	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	4
PID 2132 wrote to memory of 396	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	4
PID 2132 wrote to memory of 396	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	4
PID 2132 wrote to memory of 396	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	4
PID 2132 wrote to memory of 396	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	4
PID 2132 wrote to memory of 396	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	4
PID 2132 wrote to memory of 396	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	4
PID 2132 wrote to memory of 432	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	5
PID 2132 wrote to memory of 432	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	5
PID 2132 wrote to memory of 432	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	5
PID 2132 wrote to memory of 432	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	5
PID 2132 wrote to memory of 432	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	5
PID 2132 wrote to memory of 432	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	5
PID 2132 wrote to memory of 432	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	5
PID 2132 wrote to memory of 476	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	6
PID 2132 wrote to memory of 476	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	6
PID 2132 wrote to memory of 476	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	6
PID 2132 wrote to memory of 476	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	6
PID 2132 wrote to memory of 476	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	6
PID 2132 wrote to memory of 476	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	6
PID 2132 wrote to memory of 476	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	6
PID 2132 wrote to memory of 492	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	7
PID 2132 wrote to memory of 492	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	7
PID 2132 wrote to memory of 492	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	7
PID 2132 wrote to memory of 492	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	7
PID 2132 wrote to memory of 492	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	7
PID 2132 wrote to memory of 492	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	7
PID 2132 wrote to memory of 492	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	7
PID 2132 wrote to memory of 500	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	8
PID 2132 wrote to memory of 500	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	8
PID 2132 wrote to memory of 500	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	8
PID 2132 wrote to memory of 500	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	8
PID 2132 wrote to memory of 500	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	8
PID 2132 wrote to memory of 500	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	8
PID 2132 wrote to memory of 500	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	8
PID 2132 wrote to memory of 596	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	9
PID 2132 wrote to memory of 596	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	9
PID 2132 wrote to memory of 596	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	9
PID 2132 wrote to memory of 596	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	9
PID 2132 wrote to memory of 596	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	9
PID 2132 wrote to memory of 596	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	9
PID 2132 wrote to memory of 596	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	9
PID 2132 wrote to memory of 672	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	10
PID 2132 wrote to memory of 672	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	10
PID 2132 wrote to memory of 672	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	10
PID 2132 wrote to memory of 672	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	10
PID 2132 wrote to memory of 672	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	10
PID 2132 wrote to memory of 672	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	10
PID 2132 wrote to memory of 672	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	10
PID 2132 wrote to memory of 760	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	11
PID 2132 wrote to memory of 760	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	11
PID 2132 wrote to memory of 760	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	11
PID 2132 wrote to memory of 760	2132	ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe	11

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1676
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:820
  - - C:\Windows\helppane.exe
      C:\Windows\helppane.exe -Embedding
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2644
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:760
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:236
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:108
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1028
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1112
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1516
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1728
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1272
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
    C:\Users\Admin\AppData\Local\Temp\ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2132

C:\Users\Admin\AppData\Local\Temp\2726044927\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\2726044927\zmstage.exe
1⤵
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ad02bd63c55b08e4f74e2eaeceb3795a_JaffaCakes118mgr.exe

Filesize
276KB

MD5
da3aa2c43a90fef038c022bf37506772

SHA1
51dfca709fdeb6f593f35d4232133534e6109168

SHA256
1906eb8bc5bcdf34e360416176eb90e226c95a490c679e00de38393c2741ce66

SHA512
ad3b103396f42131ab630a740435ecec30485da9655ee4cdeb8e5510262bffa8218117a7120ad59bfa1035777cdd5b07471361056144748d5f74a55831016648

Download Submit
memory/2132-12-0x00000000777EF000-0x00000000777F0000-memory.dmp

Filesize
4KB

Download
memory/2132-10-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2132-14-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2132-11-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2132-15-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2132-13-0x00000000777F0000-0x00000000777F1000-memory.dmp

Filesize
4KB

Download
memory/2644-32-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2644-19-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2976-9-0x00000000001D0000-0x0000000000251000-memory.dmp

Filesize
516KB

Download
memory/2976-17-0x00000000777EF000-0x00000000777F0000-memory.dmp

Filesize
4KB

Download
memory/2976-18-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/2976-21-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/2976-20-0x0000000001000000-0x0000000001052000-memory.dmp

Filesize
328KB

Download
memory/2976-1-0x0000000001000000-0x0000000001052000-memory.dmp

Filesize
328KB

Download