4f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66

Resubmissions

16/10/2024, 02:26

241016-cwyacaxhmd 10

16/10/2024, 02:19

241016-csapwasbjm 10

Analysis

max time kernel
67s
max time network
68s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16/10/2024, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
Size

364KB
MD5

4affa384ff6ab351df42fc3a02716670
SHA1

7bebae1ad50fd27c3df625dc3995256f7d8bb8c2
SHA256

4f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66
SHA512

802616cac860ed2facd74387475e45ecd5a9e00fb106db801cd0168659fcecb9bb0ca6afb4cfeeca592d24d20c07add685e9a65c3178c839d37850a324906070
SSDEEP

6144:rHDYm7R++Qhm/FxsB+lIB+0ODLawCi308Ki7B4iTK24D1sr:rHr2mwB+g03S5idVK24Zsr

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+REcovER+jpspt+.txt

Ransom Note

{}_~_~+ -$.-_+$|~~_|| =|_$.**+-~| $+|=*.-=| !!! IMPORTANT INFORMATION !!!! All of your files are encrypted with RSA-4096. More information about the RSA algorythm can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server. To receive your private key follow one of the links: 1. http://88fga.ketteaero.com/80DFA9A1775787B3 2. http://2bdfb.spinakrosa.at/80DFA9A1775787B3 3. http://uj5nj.onanwhit.com/80DFA9A1775787B3 If all of the addresses are not available, follow these steps: 1. Download and install Tor Browser: https://www.torproject.org/download/download-easy.html 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: k7tlx3ghr3m4n2tu.onion/80DFA9A1775787B3 4. Follow the instructions on the site. !!! Your personal identification ID: 80DFA9A1775787B3 !!! )(*=~_$~+$==-$*~=$$ __$-=-+*

URLs

http://88fga.ketteaero.com/80DFA9A1775787B3

http://2bdfb.spinakrosa.at/80DFA9A1775787B3

http://uj5nj.onanwhit.com/80DFA9A1775787B3

http://k7tlx3ghr3m4n2tu.onion/80DFA9A1775787B3

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Deletes itself 1 IoCs

pid	Process
1492	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2056	llxcge.exe
980	llxcge.exe

Loads dropped DLL 2 IoCs

pid	Process
2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\vssueylqq = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START \"\" \"C:\\Users\\Admin\\Documents\\llxcge.exe\""	llxcge.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2056 set thread context of 980	2056	llxcge.exe	40

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\+REcovER+jpspt+.png	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\+REcovER+jpspt+.txt	llxcge.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\+REcovER+jpspt+.txt	llxcge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	llxcge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	llxcge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
496	vssadmin.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Axronics	llxcge.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe
980	llxcge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	llxcge.exe
Token: SeBackupPrivilege	2448	vssvc.exe
Token: SeRestorePrivilege	2448	vssvc.exe
Token: SeAuditPrivilege	2448	vssvc.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2316 wrote to memory of 2020	2316	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	34
PID 2020 wrote to memory of 2056	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	35
PID 2020 wrote to memory of 2056	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	35
PID 2020 wrote to memory of 2056	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	35
PID 2020 wrote to memory of 2056	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	35
PID 2020 wrote to memory of 1492	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	36
PID 2020 wrote to memory of 1492	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	36
PID 2020 wrote to memory of 1492	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	36
PID 2020 wrote to memory of 1492	2020	4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe	36
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 2056 wrote to memory of 980	2056	llxcge.exe	40
PID 980 wrote to memory of 496	980	llxcge.exe	41
PID 980 wrote to memory of 496	980	llxcge.exe	41
PID 980 wrote to memory of 496	980	llxcge.exe	41
PID 980 wrote to memory of 496	980	llxcge.exe	41

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	llxcge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	llxcge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4affa384ff6ab351df42fc3a02716670_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\Documents\llxcge.exe
    C:\Users\Admin\Documents\llxcge.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Users\Admin\Documents\llxcge.exe
      C:\Users\Admin\Documents\llxcge.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:980
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:496
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4AFFA3~1.EXE >> NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:1492

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+REcovER+jpspt+.png

Filesize
37KB

MD5
c1a26be8701bb973b6a1ea9055a14e32

SHA1
91643141c8d3f53e9726925cc2828cf3a39c9443

SHA256
f40ed5ea0d422465778358abfbe8524fe6d1fa3c0ac6bf7b8bad723b8baf3148

SHA512
6d747697ec09d84e2ec31bc14d5c7629d8c1c1a3c1e516f376787897e8a24159e53e98eaf63d21f063748f9dbe04a072477cddbaf395be59b7ec543decb0002b

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+REcovER+jpspt+.txt

Filesize
1KB

MD5
03f0d758a8e55d0481e0d6285dcfae8d

SHA1
87b703d20339aaff8447bc059df4129736b3e24e

SHA256
54ff1131813e2f3034c3d675b645c8ea2c385d05cc258dc0b5b8f3c1758a4d4d

SHA512
0d3e84fa46907427671c4a8f586d7241629d2d9d494c2f79c9dfc5830ddacdd8ef21b19ce8aee83e67cf28bd29aeb81a39ef71ed514a995f58c00ea420ffa2a9

Download Submit
\Users\Admin\Documents\llxcge.exe

Filesize
364KB

MD5
4affa384ff6ab351df42fc3a02716670

SHA1
7bebae1ad50fd27c3df625dc3995256f7d8bb8c2

SHA256
4f1e783f68071d95e0b07e1f8b80ed49d0d94a089ae96016b197f846350cfe66

SHA512
802616cac860ed2facd74387475e45ecd5a9e00fb106db801cd0168659fcecb9bb0ca6afb4cfeeca592d24d20c07add685e9a65c3178c839d37850a324906070

Download Submit
memory/980-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-52-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-10-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-8-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2020-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-33-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/2316-17-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/2316-0-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/2316-1-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download