ryuk | 956246824d2fb2f5f4738c450e8d222042b08c3e5c67c3ec755bedf641b7b1c5

Analysis

max time kernel
102s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
23-03-2021 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xxx.exe
Size

208KB
MD5

3c08d1e5233c623bfc854879173544de
SHA1

a1add1d1e80d84440fc013abcc754f1bdddf3a20
SHA256

956246824d2fb2f5f4738c450e8d222042b08c3e5c67c3ec755bedf641b7b1c5
SHA512

01adb468d0318f44532f5222fff6f06eb5128b6b368d2a939b0e5c54da592784e793f97a1a9617f908cf0b2b61c61253ec0157433faf3894cc34e63fbbc5a943

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'UDmHKcEqZ'; $torlink = 'http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
3836	BDAZhEPfKrep.exe
1020	XhhxlwuMSlan.exe
1524	VFlVgQGNclan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4484	icacls.exe
4496	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	xxx.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\PREVIEW.GIF	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\platform.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\PIXEL.ELM	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\NATIVESHIM.RESOURCES.DLL	xxx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_HK.properties	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	xxx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\PowerPointCapabilities.json	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC	xxx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\RyukReadMe.html	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar	xxx.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-awt.jar	xxx.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\tzdb.dat	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms	xxx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\SETUP.CHM	xxx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5908	schtasks.exe
5972	schtasks.exe
4820	schtasks.exe
5732	schtasks.exe
1480	schtasks.exe
6092	schtasks.exe
5532	schtasks.exe
5828	schtasks.exe
5744	schtasks.exe
5044	schtasks.exe
4788	schtasks.exe
4996	schtasks.exe
5508	schtasks.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1056	xxx.exe
1056	xxx.exe
1056	xxx.exe
1056	xxx.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3836	1056	xxx.exe	78
PID 1056 wrote to memory of 3836	1056	xxx.exe	78
PID 1056 wrote to memory of 3836	1056	xxx.exe	78
PID 1056 wrote to memory of 1020	1056	xxx.exe	79
PID 1056 wrote to memory of 1020	1056	xxx.exe	79
PID 1056 wrote to memory of 1020	1056	xxx.exe	79
PID 1056 wrote to memory of 1524	1056	xxx.exe	80
PID 1056 wrote to memory of 1524	1056	xxx.exe	80
PID 1056 wrote to memory of 1524	1056	xxx.exe	80
PID 1056 wrote to memory of 4484	1056	xxx.exe	81
PID 1056 wrote to memory of 4484	1056	xxx.exe	81
PID 1056 wrote to memory of 4484	1056	xxx.exe	81
PID 1056 wrote to memory of 4496	1056	xxx.exe	82
PID 1056 wrote to memory of 4496	1056	xxx.exe	82
PID 1056 wrote to memory of 4496	1056	xxx.exe	82
PID 1056 wrote to memory of 4960	1056	xxx.exe	85
PID 1056 wrote to memory of 4960	1056	xxx.exe	85
PID 1056 wrote to memory of 4960	1056	xxx.exe	85
PID 1056 wrote to memory of 4652	1056	xxx.exe	86
PID 1056 wrote to memory of 4652	1056	xxx.exe	86
PID 1056 wrote to memory of 4652	1056	xxx.exe	86
PID 1056 wrote to memory of 4728	1056	xxx.exe	89
PID 1056 wrote to memory of 4728	1056	xxx.exe	89
PID 1056 wrote to memory of 4728	1056	xxx.exe	89
PID 1056 wrote to memory of 4916	1056	xxx.exe	91
PID 1056 wrote to memory of 4916	1056	xxx.exe	91
PID 1056 wrote to memory of 4916	1056	xxx.exe	91
PID 4960 wrote to memory of 4956	4960	net.exe	96
PID 4960 wrote to memory of 4956	4960	net.exe	96
PID 4960 wrote to memory of 4956	4960	net.exe	96
PID 4728 wrote to memory of 4708	4728	net.exe	95
PID 4728 wrote to memory of 4708	4728	net.exe	95
PID 4728 wrote to memory of 4708	4728	net.exe	95
PID 4652 wrote to memory of 4736	4652	net.exe	93
PID 4652 wrote to memory of 4736	4652	net.exe	93
PID 4652 wrote to memory of 4736	4652	net.exe	93
PID 4916 wrote to memory of 5144	4916	net.exe	94
PID 4916 wrote to memory of 5144	4916	net.exe	94
PID 4916 wrote to memory of 5144	4916	net.exe	94

C:\Users\Admin\AppData\Local\Temp\xxx.exe
"C:\Users\Admin\AppData\Local\Temp\xxx.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\BDAZhEPfKrep.exe
  "C:\Users\Admin\AppData\Local\Temp\BDAZhEPfKrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:3836
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.75 /TN VIFrxEi /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.88 /TN TlhIwJN /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5908
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.95 /TN 9cAhvcr /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5972
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.77 /TN ytpK4NT /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4820
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.66 /TN dBgLC9o /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5532
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.73 /TN gpyELi9 /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5828
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.78 /TN 9eeJfxa /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5744
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.70 /TN TTDIaJW /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5044
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.86 /TN lTGwsLu /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.81 /TN YQljtCI /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4996
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.71 /TN jqLXQOr /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1480
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.84 /TN eCiHB2B /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5732
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.72 /TN ytRRbQg /TR "C:\Users\Public\BDAZhEPfKrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5508
- C:\Users\Admin\AppData\Local\Temp\XhhxlwuMSlan.exe
  "C:\Users\Admin\AppData\Local\Temp\XhhxlwuMSlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\VFlVgQGNclan.exe
  "C:\Users\Admin\AppData\Local\Temp\VFlVgQGNclan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4484
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4496
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4956
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4736
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4708
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-14-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/1056-23-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/1056-24-0x0000000003740000-0x0000000003741000-memory.dmp

Filesize
4KB

Download
memory/1056-3-0x0000000002110000-0x0000000002130000-memory.dmp

Filesize
128KB

Download
memory/1056-4-0x0000000035000000-0x000000003502A000-memory.dmp

Filesize
168KB

Download
memory/1056-2-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/1524-20-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/3836-8-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download