wannacry | a60b47e8c834aa97ddda9bd70dd41d8dc61649fd878ea913bc242ae79fe8cc77

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
faed32ee420704e18792dadaade82c2d.dll
Size 5.0MB
Sample220720-dzrseabdb2
SHA256 a60b47e8c834aa97ddda9bd70dd41d8dc61649fd878ea913bc242ae79fe8cc77
MD5 faed32ee420704e18792dadaade82c2d
SHA1 3386d17c56ad13ab1ed43829a1d90a72453e8c3c
SHA512 865d77647dd622bd68330f5af9238c98f9fd272f1aa4cdf24f2c73937c4215d904b9162376bab4dbef0734254c99634056038a89cf9040a373c2cd796d40ed0b
MD5 SHA1 SHA512

Score

10^/10

wannacry discovery evasion ransomware worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	mssecsvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	mssecsvc.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1"	mssecsvc.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3304) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Executes dropped EXE 2 IoCs

pid	Process
992	mssecsvc.exe
4640	mssecsvc.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4204	992	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
992	mssecsvc.exe
992	mssecsvc.exe
4640	mssecsvc.exe
4640	mssecsvc.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
992	mssecsvc.exe
4640	mssecsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	mssecsvc.exe
Token: SeDebugPrivilege	4640	mssecsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1032	5100	rundll32.exe	76
PID 5100 wrote to memory of 1032	5100	rundll32.exe	76
PID 5100 wrote to memory of 1032	5100	rundll32.exe	76
PID 1032 wrote to memory of 992	1032	rundll32.exe	77
PID 1032 wrote to memory of 992	1032	rundll32.exe	77
PID 1032 wrote to memory of 992	1032	rundll32.exe	77
PID 992 wrote to memory of 576	992	mssecsvc.exe	6
PID 992 wrote to memory of 576	992	mssecsvc.exe	6
PID 992 wrote to memory of 576	992	mssecsvc.exe	6
PID 992 wrote to memory of 576	992	mssecsvc.exe	6
PID 992 wrote to memory of 576	992	mssecsvc.exe	6
PID 992 wrote to memory of 576	992	mssecsvc.exe	6
PID 992 wrote to memory of 668	992	mssecsvc.exe	4
PID 992 wrote to memory of 668	992	mssecsvc.exe	4
PID 992 wrote to memory of 668	992	mssecsvc.exe	4
PID 992 wrote to memory of 668	992	mssecsvc.exe	4
PID 992 wrote to memory of 668	992	mssecsvc.exe	4
PID 992 wrote to memory of 668	992	mssecsvc.exe	4
PID 992 wrote to memory of 760	992	mssecsvc.exe	8
PID 992 wrote to memory of 760	992	mssecsvc.exe	8
PID 992 wrote to memory of 760	992	mssecsvc.exe	8
PID 992 wrote to memory of 760	992	mssecsvc.exe	8
PID 992 wrote to memory of 760	992	mssecsvc.exe	8
PID 992 wrote to memory of 760	992	mssecsvc.exe	8
PID 992 wrote to memory of 764	992	mssecsvc.exe	75
PID 992 wrote to memory of 764	992	mssecsvc.exe	75
PID 992 wrote to memory of 764	992	mssecsvc.exe	75
PID 992 wrote to memory of 764	992	mssecsvc.exe	75
PID 992 wrote to memory of 764	992	mssecsvc.exe	75
PID 992 wrote to memory of 764	992	mssecsvc.exe	75
PID 992 wrote to memory of 784	992	mssecsvc.exe	74
PID 992 wrote to memory of 784	992	mssecsvc.exe	74
PID 992 wrote to memory of 784	992	mssecsvc.exe	74
PID 992 wrote to memory of 784	992	mssecsvc.exe	74
PID 992 wrote to memory of 784	992	mssecsvc.exe	74
PID 992 wrote to memory of 784	992	mssecsvc.exe	74
PID 992 wrote to memory of 896	992	mssecsvc.exe	73
PID 992 wrote to memory of 896	992	mssecsvc.exe	73
PID 992 wrote to memory of 896	992	mssecsvc.exe	73
PID 992 wrote to memory of 896	992	mssecsvc.exe	73
PID 992 wrote to memory of 896	992	mssecsvc.exe	73
PID 992 wrote to memory of 896	992	mssecsvc.exe	73
PID 992 wrote to memory of 940	992	mssecsvc.exe	72
PID 992 wrote to memory of 940	992	mssecsvc.exe	72
PID 992 wrote to memory of 940	992	mssecsvc.exe	72
PID 992 wrote to memory of 940	992	mssecsvc.exe	72
PID 992 wrote to memory of 940	992	mssecsvc.exe	72
PID 992 wrote to memory of 940	992	mssecsvc.exe	72
PID 992 wrote to memory of 1008	992	mssecsvc.exe	71
PID 992 wrote to memory of 1008	992	mssecsvc.exe	71
PID 992 wrote to memory of 1008	992	mssecsvc.exe	71
PID 992 wrote to memory of 1008	992	mssecsvc.exe	71
PID 992 wrote to memory of 1008	992	mssecsvc.exe	71
PID 992 wrote to memory of 1008	992	mssecsvc.exe	71
PID 992 wrote to memory of 404	992	mssecsvc.exe	70
PID 992 wrote to memory of 404	992	mssecsvc.exe	70
PID 992 wrote to memory of 404	992	mssecsvc.exe	70
PID 992 wrote to memory of 404	992	mssecsvc.exe	70
PID 992 wrote to memory of 404	992	mssecsvc.exe	70
PID 992 wrote to memory of 404	992	mssecsvc.exe	70
PID 992 wrote to memory of 624	992	mssecsvc.exe	9
PID 992 wrote to memory of 624	992	mssecsvc.exe	9
PID 992 wrote to memory of 624	992	mssecsvc.exe	9
PID 992 wrote to memory of 624	992	mssecsvc.exe	9

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:576
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:764

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1992

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2676

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3456

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2312

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:632

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4144

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3968

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3668

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:380
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\faed32ee420704e18792dadaade82c2d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\faed32ee420704e18792dadaade82c2d.dll,#1
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\WINDOWS\mssecsvc.exe
      C:\WINDOWS\mssecsvc.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1324
        5⤵
        Program crash
        
        PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2476

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 992 -ip 992
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 9c415ab9b62fd48ccc69ac52bb02e2434251e2bf284c0fa8c3ce4e92a8491181
MD5 6bfb87be19b27ae2bfc5e42931772470
SHA1 37a6cf87d9c50300302db60a8c23b8542c585a2c
SHA512 1afb98e69194ded7230f0a313d67d10d0a1be3c70a7ea129463a51b2ad5723e6965d8cc5e67d049ae3897709c94295fa5dc1a0af59d9a5d4f61269089c439ab5
SSDEEP 6144:wE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh9kH/3U:wwbLgPluxQh9Gk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 9c415ab9b62fd48ccc69ac52bb02e2434251e2bf284c0fa8c3ce4e92a8491181
MD5 6bfb87be19b27ae2bfc5e42931772470
SHA1 37a6cf87d9c50300302db60a8c23b8542c585a2c
SHA512 1afb98e69194ded7230f0a313d67d10d0a1be3c70a7ea129463a51b2ad5723e6965d8cc5e67d049ae3897709c94295fa5dc1a0af59d9a5d4f61269089c439ab5
SSDEEP 6144:wE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh9kH/3U:wwbLgPluxQh9Gk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 9c415ab9b62fd48ccc69ac52bb02e2434251e2bf284c0fa8c3ce4e92a8491181
MD5 6bfb87be19b27ae2bfc5e42931772470
SHA1 37a6cf87d9c50300302db60a8c23b8542c585a2c
SHA512 1afb98e69194ded7230f0a313d67d10d0a1be3c70a7ea129463a51b2ad5723e6965d8cc5e67d049ae3897709c94295fa5dc1a0af59d9a5d4f61269089c439ab5
SSDEEP 6144:wE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh9kH/3U:wwbLgPluxQh9Gk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/992-135-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/992-137-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/992-138-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/992-139-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Download

memory/4640-136-0x0000000000400000-0x0000000000A72000-memory.dmp

Download

memory/4640-140-0x0000000000400000-0x0000000000A72000-memory.dmp

Download