chaos | 95eaf7092864e622c9bca0a5a3339480d03adaf19f069f5419de52c8f7f75a69

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-07-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe
Size

24KB
MD5

0bc7112ee4755de56b7fb22758e47182
SHA1

bb2d11065ada048f80786deb072fbdbc265415a0
SHA256

95eaf7092864e622c9bca0a5a3339480d03adaf19f069f5419de52c8f7f75a69
SHA512

846a28920edae418648c09e24680d459b74f9a2a7ca02ddf06ee51bd6a7c34afb86b02b7aff615fda749acbdce0f4388801e4e25360737cad6bd05d320a9fed9
SSDEEP

384:9YenjLLAvOGnLR1TYZdiI8YSxswOVp91kodUxDGg:MmGLHTYZ36c9zmxDb

Score

10^/10

chaos defense_evasion evasion execution impact ransomware spyware stealer

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2120-1-0x00000000011E0000-0x00000000011EC000-memory.dmp	family_chaos
behavioral1/files/0x000d000000012731-5.dat	family_chaos
behavioral1/memory/2796-7-0x0000000000DB0000-0x0000000000DBC000-memory.dmp	family_chaos

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1972	bcdedit.exe
2056	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1924	wbadmin.exe

Disables Task Manager via registry modification
evasion

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svc.url	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svc.exe

Executes dropped EXE 1 IoCs

pid	Process
2796	svc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svc.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svc.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FH198YO1\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svc.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLI5Q0EH\desktop.ini	svc.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	svc.exe
File opened for modification	C:\Users\Public\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJW4QSK9\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JVMDVGRW\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svc.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9P9LRO9\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OJBRRE9R\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svc.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svc.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	svc.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svc.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini	svc.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\G4UA8T7D\desktop.ini	svc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2548	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2424	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2796	svc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2120	2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe
2120	2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe
2120	2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe
2796	svc.exe
2796	svc.exe
2796	svc.exe
2796	svc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe
Token: SeDebugPrivilege	2796	svc.exe
Token: SeBackupPrivilege	2828	vssvc.exe
Token: SeRestorePrivilege	2828	vssvc.exe
Token: SeAuditPrivilege	2828	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1124	WMIC.exe
Token: SeSecurityPrivilege	1124	WMIC.exe
Token: SeTakeOwnershipPrivilege	1124	WMIC.exe
Token: SeLoadDriverPrivilege	1124	WMIC.exe
Token: SeSystemProfilePrivilege	1124	WMIC.exe
Token: SeSystemtimePrivilege	1124	WMIC.exe
Token: SeProfSingleProcessPrivilege	1124	WMIC.exe
Token: SeIncBasePriorityPrivilege	1124	WMIC.exe
Token: SeCreatePagefilePrivilege	1124	WMIC.exe
Token: SeBackupPrivilege	1124	WMIC.exe
Token: SeRestorePrivilege	1124	WMIC.exe
Token: SeShutdownPrivilege	1124	WMIC.exe
Token: SeDebugPrivilege	1124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1124	WMIC.exe
Token: SeRemoteShutdownPrivilege	1124	WMIC.exe
Token: SeUndockPrivilege	1124	WMIC.exe
Token: SeManageVolumePrivilege	1124	WMIC.exe
Token: 33	1124	WMIC.exe
Token: 34	1124	WMIC.exe
Token: 35	1124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1124	WMIC.exe
Token: SeSecurityPrivilege	1124	WMIC.exe
Token: SeTakeOwnershipPrivilege	1124	WMIC.exe
Token: SeLoadDriverPrivilege	1124	WMIC.exe
Token: SeSystemProfilePrivilege	1124	WMIC.exe
Token: SeSystemtimePrivilege	1124	WMIC.exe
Token: SeProfSingleProcessPrivilege	1124	WMIC.exe
Token: SeIncBasePriorityPrivilege	1124	WMIC.exe
Token: SeCreatePagefilePrivilege	1124	WMIC.exe
Token: SeBackupPrivilege	1124	WMIC.exe
Token: SeRestorePrivilege	1124	WMIC.exe
Token: SeShutdownPrivilege	1124	WMIC.exe
Token: SeDebugPrivilege	1124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1124	WMIC.exe
Token: SeRemoteShutdownPrivilege	1124	WMIC.exe
Token: SeUndockPrivilege	1124	WMIC.exe
Token: SeManageVolumePrivilege	1124	WMIC.exe
Token: 33	1124	WMIC.exe
Token: 34	1124	WMIC.exe
Token: 35	1124	WMIC.exe
Token: SeBackupPrivilege	660	wbengine.exe
Token: SeRestorePrivilege	660	wbengine.exe
Token: SeSecurityPrivilege	660	wbengine.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2796	2120	2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe	31
PID 2120 wrote to memory of 2796	2120	2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe	31
PID 2120 wrote to memory of 2796	2120	2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe	31
PID 2796 wrote to memory of 2900	2796	svc.exe	32
PID 2796 wrote to memory of 2900	2796	svc.exe	32
PID 2796 wrote to memory of 2900	2796	svc.exe	32
PID 2900 wrote to memory of 2548	2900	cmd.exe	34
PID 2900 wrote to memory of 2548	2900	cmd.exe	34
PID 2900 wrote to memory of 2548	2900	cmd.exe	34
PID 2900 wrote to memory of 1124	2900	cmd.exe	37
PID 2900 wrote to memory of 1124	2900	cmd.exe	37
PID 2900 wrote to memory of 1124	2900	cmd.exe	37
PID 2796 wrote to memory of 2964	2796	svc.exe	39
PID 2796 wrote to memory of 2964	2796	svc.exe	39
PID 2796 wrote to memory of 2964	2796	svc.exe	39
PID 2964 wrote to memory of 1972	2964	cmd.exe	41
PID 2964 wrote to memory of 1972	2964	cmd.exe	41
PID 2964 wrote to memory of 1972	2964	cmd.exe	41
PID 2964 wrote to memory of 2056	2964	cmd.exe	42
PID 2964 wrote to memory of 2056	2964	cmd.exe	42
PID 2964 wrote to memory of 2056	2964	cmd.exe	42
PID 2796 wrote to memory of 2176	2796	svc.exe	43
PID 2796 wrote to memory of 2176	2796	svc.exe	43
PID 2796 wrote to memory of 2176	2796	svc.exe	43
PID 2176 wrote to memory of 1924	2176	cmd.exe	45
PID 2176 wrote to memory of 1924	2176	cmd.exe	45
PID 2176 wrote to memory of 1924	2176	cmd.exe	45
PID 2796 wrote to memory of 2424	2796	svc.exe	50
PID 2796 wrote to memory of 2424	2796	svc.exe	50
PID 2796 wrote to memory of 2424	2796	svc.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-28_0bc7112ee4755de56b7fb22758e47182_destroyer_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Roaming\svc.exe
  "C:\Users\Admin\AppData\Roaming\svc.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1972
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2056
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1924
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\read_it.txt

Filesize
39B

MD5
3b3e0dd3e4aacca142ceafe85ca241c4

SHA1
a1d3d848af04f434ea3e22b3d4162d2c123c66ff

SHA256
5974342e3165d7b59d045e226c7081d89f6695ec145b037172e6e562229079a3

SHA512
139c99ec632c9799355cf5972520a7a926b6349c6740a00c9a71b74da8659eaacc4bac6264c1bb3187a86893b97ae8a0e5d75522f2ad19e5108d6d69f10465e4

Download Submit
C:\Users\Admin\AppData\Roaming\EnableUnblock.cab

Filesize
1B

MD5
d1457b72c3fb323a2671125aef3eab5d

SHA1
5bab61eb53176449e25c2c82f172b82cb13ffb9d

SHA256
8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

SHA512
ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

Download Submit
C:\Users\Admin\AppData\Roaming\svc.exe

Filesize
24KB

MD5
0bc7112ee4755de56b7fb22758e47182

SHA1
bb2d11065ada048f80786deb072fbdbc265415a0

SHA256
95eaf7092864e622c9bca0a5a3339480d03adaf19f069f5419de52c8f7f75a69

SHA512
846a28920edae418648c09e24680d459b74f9a2a7ca02ddf06ee51bd6a7c34afb86b02b7aff615fda749acbdce0f4388801e4e25360737cad6bd05d320a9fed9

Download Submit
memory/2120-0-0x000007FEF62D3000-0x000007FEF62D4000-memory.dmp

Filesize
4KB

Download
memory/2120-1-0x00000000011E0000-0x00000000011EC000-memory.dmp

Filesize
48KB

Download
memory/2796-7-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/2796-9-0x000007FEF62D0000-0x000007FEF6CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2796-73-0x000007FEF62D0000-0x000007FEF6CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2796-946-0x000007FEF62D0000-0x000007FEF6CBC000-memory.dmp

Filesize
9.9MB

Download