ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Analysis

max time kernel
140s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Size

140KB
MD5

75a3cf8ced873ee7bc415e27e108496b
SHA1

ac94165d63c75f4adf1728aa2ecb776ac7c1c18e
SHA256

5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed
SHA512

7c3e166ff75ad32f70bfb355167333be4f9bc5b5740a231b4a1fb5c391bd8e137ebea6a3ba5370797f016cbdb83631bb5e459e0bc64beb3246ed9605b3bdb903

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = '5PcRSFW'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
2752	cHxyBbAEorep.exe
992	bXmnBcHhglan.exe
1488	DjoFjvcpnlan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3856	icacls.exe
3832	icacls.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\N:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\F:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\V:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\T:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\R:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\W:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\U:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\M:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\L:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\K:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\Z:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\Y:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\X:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\S:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\J:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\H:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\G:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\E:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\Q:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\P:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened (read-only)	\??\I:	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\jni.h	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansDemiBold.ttf	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\jconsole.jar	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\cursors.properties	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkClientCP	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_de_DE.jar	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.properties.src	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.jar	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\jawt.lib	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\System\ado\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterRegular.ttf	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\jvm.cfg	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\javaws.policy	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management-agent.jar	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\RyukReadMe.html	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\dt.jar	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox28.tlb	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.bfc	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterBold.ttf	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2752	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	78
PID 744 wrote to memory of 2752	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	78
PID 744 wrote to memory of 2752	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	78
PID 744 wrote to memory of 992	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	79
PID 744 wrote to memory of 992	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	79
PID 744 wrote to memory of 992	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	79
PID 744 wrote to memory of 1488	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	80
PID 744 wrote to memory of 1488	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	80
PID 744 wrote to memory of 1488	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	80
PID 744 wrote to memory of 3856	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	81
PID 744 wrote to memory of 3856	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	81
PID 744 wrote to memory of 3856	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	81
PID 744 wrote to memory of 3832	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	82
PID 744 wrote to memory of 3832	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	82
PID 744 wrote to memory of 3832	744	5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe	82

C:\Users\Admin\AppData\Local\Temp\5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
"C:\Users\Admin\AppData\Local\Temp\5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\cHxyBbAEorep.exe
  "C:\Users\Admin\AppData\Local\Temp\cHxyBbAEorep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\bXmnBcHhglan.exe
  "C:\Users\Admin\AppData\Local\Temp\bXmnBcHhglan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Users\Admin\AppData\Local\Temp\DjoFjvcpnlan.exe
  "C:\Users\Admin\AppData\Local\Temp\DjoFjvcpnlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3856
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-46-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-55-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-16-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-19-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-20-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-18-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-21-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-90-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-22-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-88-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-27-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-26-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-24-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-28-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-29-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-30-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-31-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-32-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-33-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-34-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-36-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-35-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-11-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-38-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-40-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-39-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-41-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-42-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-43-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-44-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-45-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-89-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-48-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-47-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-49-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-50-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-51-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-52-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-54-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-17-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-56-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-57-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-53-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-59-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-60-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-58-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-62-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-61-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-63-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-65-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-67-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-66-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-68-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-64-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-69-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-70-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-71-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-75-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-15-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-14-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-13-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-76-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-77-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-78-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-80-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-79-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-81-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-82-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-83-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-12-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/744-84-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-86-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/744-87-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download