Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/10/2026, 04:19
General
- Target jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe
- Size 284KB
- Sample261016-exvxqahs3k
- SHA256 62cce749fcfaf6ffc33593f37510701268d21d75f09d15a2d8545f341a4426d8
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Downloads\!HELP_SOS.hta
Ransom Note
- English Deutsch Italiano Português Español Français 한국어 Nederlands العربية فارسی 中文 The file is encrypted but can be restored Die Datei ist verschlüsselt, aber kann wiederhergestellt werden Il file è crittografato, ma può essere ripristinato O arquivo está criptografado, mas poderá ser descriptografado El archivo está encriptado pero puede ser restaurado Le fichier est crypté mais peut être restauré 파일은 암호화되었지만 복원 할 수 있습니다 Het bestand is versleuteld maar kan worden hersteld الملف مشفر لكن من الممكن إسترجاعه این فایل رمزگذاری شده است اما می تواند بازیابی شود 文件已被加密，但是可以解密 The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware". Action required to restore your files. File recovery instructions You probably noticed that you can not open your files and that some software stopped working correctly. This is expected. Your files content is still there, but it was encrypted by "SAGE 2.2 Ransomware" . Your files are not lost, it is possible to revert them back to normal state by decrypting. The only way you can do that is by getting "SAGE Decrypter" software and your personal decryption key. Using any other software which claims to be able to restore your files will result in files being damaged or destroyed. You can purchase "SAGE Decrypter" software and your decryption key at your personal page you can access by following links: http://7gie6ffnkrjykggd.3io74zx.com/ If you are asked for your personal key, copy it to the form on the site. This is your personal key: ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser". In order to do that you need to: open Internet Explorer or any other internet browser; copy the address https://www.torproject.org/download/download-easy.html.en into address bar and press "Enter"; once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions; once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version); Tor Browser will establish connection and open a normal browser window; copy the address http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA into this browser address bar and press "Enter"; your personal page should be opened now; if it didn't then wait for a bit and try again. If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on YouTube. You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files. Anleitung zur Dateiwiederherstellung Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren. Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt. Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen. Die einzige Möglichkeit das zu tun, ist die Verwendung von "SAGE Decrypter" Software und Ihr persönlicher Entschlüsselungskey. Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden. Sie können die "SAGE Decrypter" Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen: http://7gie6ffnkrjykggd.3io74zx.com/ Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key: ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen. Dazu benötigen Sie: Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser; Kopieren Sie diese Adresse https://www.torproject.org/download/download-easy.html.en in die Adressleiste und drücken Sie "Enter"; So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen; Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben); Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen; Kopieren Sie die Adresse http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA in die Browseradressleiste und drücken Sie "Enter"; Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut. Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf {a_youtube}} an. Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten. Istruzioni per il recupero dei file Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente. Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da "SAGE 2.2 Ransomware" . I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione. L'unico modo in cui è possibile farlo è scaricare il software "SAGE Decrypter" e la tua chiave personale di decrittazione. Utilizzando un qualsiasi altro software che sostiene di essere in grado di ripristinare i tuoi file, li danneggerà o distruggerà per sempre. È possibile acquistare il software "SAGE Decrypter" e la tua chiave di decrittazione nella tua pagina personale a cui puoi accedere dai seguenti collegamenti: http://7gie6ffnkrjykggd.3io74zx.com/ Se viene richiesta la chiave personale, è possibile copiarla dal modulo del sito. Questa è la chiave personale: ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA Sarà anche possibile decriptare un file gratuitamente per assicurarsi che il software "SAGE Decrypter" sia in grado di recuperare i file Se nessuno dei collegamenti funziona per un periodo di tempo prolungato o è necessario ripristinare il prima possibile, è possibile accedere alla propria pagina personale anche utilizzando "Tor Browser". Per poterlo fare è necessario: aprire Internet Explorer o qualsiasi altro browser internet; copiare l'indirizzo https://www.torproject.org/download/download-easy.html.en nella barra degli indirizzi e premere "Enter"; una volta aperta la pagina, verrà offerta la possibilità di scaricare Tor Browser, scarica ed esegui il file seguendo le istruzioni di installazione; una volta completata l'installazione, aprire il nuovo Tor Browser e premere il pulsante "Connect" (il pulsante potrebbe avere un nome diverso se non si è installata la versione inglese); Tor Browser stabilirà una connessione e aprirà una normale finestra di navigazione; copiare l'indirizzo http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA nella barra degli indirizzi del browser e premere "Enter"; ora dovrebbe essere possibile aprire la pagina personale; se così non fosse, attendere qualche istante e riprovare. Se non è possibile eseguire questo passaggio, controllare la connessione internet e riprovare. Se ancora non funziona, prova a chiedere se qualche esperto di computer può farlo al posto tuo oppure dai un'occhiata a qualche video guida su YouTube. Puoi trovare una copia di queste istruzioni nel file di nome "!HELP_SOS" conservato con i tuoi file criptati. Instruções sobre como recuperar os arquivos criptografado: Você já deve ter percebido que todos os seus arquivos não estão mais acessível e alguns dos seus programas não estão funcionando corretamente. Já era de se esperar! Os seus arquivos ainda estão salvos em seu computador, porém não estão acessível porque foram criptografados por "SAGE 2.2 Ransomware" . Os seus arquivos não foram deletados, é possível descriptografá-los. A única maneira de descriptografá-los é usando o programa, "SAGE Decrypter" e a sua chave de descriptografia pessoal. Ao tentar utilizar decodificadores de terceiros para tentar restaurar os seus arquivos, irar corromper todos os seus arquivos, podendo gerar danos irreversíveis. Você pode comprar o "SAGE Decrypter" e sua chave pessoal para decodificação nos seguintes links: http://7gie6ffnkrjykggd.3io74zx.com/ Caso seja solicitado uma chave pessoal, copie e cole no formulário no site. Essa é a sua chave pessoal: ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA Você pode descriptografar um arquivo gratuitamente para ter certeza de que o "SAGE Decrypter", seja capaz de descriptografar todos os seus arquivos no seu computador. Se nenhum dos links estiver disponível no momento ou se você precisar com urgência dos seus arquivos, você também pode acessar a sua página pessoal usando o "Tor Browser". Instruções sobre como utilizá-lo: abra o Internet Explorer ou qualquer outro navegador; copie o endereço do https://www.torproject.org/download/download-easy.html.en e cole na barra de endereço em seu navegador e pressione "Enter"; quando a página for aberta em seguida, você verá as informações sobre o Navegador Tor e o link para download, abra o arquivo e siga as instruções de instalação; Quando a instalação estiver concluída, abra o Navegador Tor e pressione o botão "Connect"(o botão pode ter outro nome, se você instalou uma versão do programa que não seja em inglês); O Navegador Tor irá estabelecer uma conexão e, em seguida, abrirá uma janela no navegador; copie o endereço do http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA e cole na barra de endereço do Navegador Tor, em seguida, pressione "Enter"; a sua página pessoal irá abrir em alguns instantes; caso a página não abra, aguarde um pouco e tente novamente. Se você não conseguir executar todas as etapas, certifique-se de que você está conectado à internet e tente novamente. Se você ainda tiver dificuldade para conectar, peça ajuda a um técnico de informática para auxiliá-lo no processo ou procure vídeos que possam ajudá-lo no YouTube. Você pode encontrar uma cópia do arquivo de instrução chamado "!HELP_SOS" salvo junto ao seus arquivos criptografados. Instrucciones para la recuperación de archivos Probablemente hayas notado que no puedes abrir tus archivos y que algunas aplicaciones dejaron de funcionar correctamente. Era de esperarse. El contenido de tus archivos aún está allí, pero fué encriptado por "SAGE 2.2 Ransomware" . Tus archivos no están perdidos, es posible regresarlos a su estado normal decodificándolos. La única forma de hacerlo es con el software "SAGE Decrypter" y su clave personal de descifrado. Usar cualquier otro software que asegure ser capaz de restaurar tus archivos resultará en un daño o destrucción de los archivos. Puedes comprar el software "SAGE Decrypter" y tu clave de descifrado en tu página personal que puedes accesar a través de los siguientes links: http://7gie6ffnkrjykggd.3io74zx.com/ Si te es solicitada la clave personal, cópiala en el formulario del sitio. Esta es tu clave personal: ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA También podrás descifrar un archivo gratis para asegurarte que el software "SAGE Decrypter" es capaz de recuperar tus archivos Si ninguno de esos links te funciona por un tiempo prolongado o si necesitas recuperar tus archivos lo más rápido posible, también puedes accesar a tu página personal usando el "Tor Browser". Con la finalidad de hacerlo necesitas: abrir Internet Explorer o cualquier otro navegador de internet; copia la dirección https://www.torproject.org/download/download-easy.html.en en la barra de direcciones y presiona "Enter"; una vez que abra la página, le será ofrecida la descarga de Tor Browser, descárgalo y ejecuta el instalador, siguiendo las instrucciones de instalación; una vez culminada la instalación, abre el recien instalado Tor Browser y presione el botón "Connect" (el botón puede tener un nombre diferente dependiendo de la versión instalada); copia la dirección http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA en la barra de direcciones del navegador y presiona "Enter"; tu página personal debería abrir ahora; si no lo hace, espera un momento e intenta de nuevo. Si no puedes hacer el procedimiento, chequea tu conexión a internet e inténtalo de nuevo. Si aún no funciona, intenta pidiéndole ayuda a un técnico de computación para seguir las instrucciones o mira algunos videos de ayuda en YouTube. Puedes encontrar una copia de estas instrucciones en los archivos llamados "!HELP_SOS" almacenados junto a tus archivos encriptados. Les instructions pour restaurer le fichier Vous avez sûrement remarqué que vous ne pouvez pas ouvrir vos fichiers et qu’un logiciel a arrêté de fonctionner correctement. C’est attendu. Le contenu de vos fichiers est encore disponible, mais il a été crypté par "SAGE 2.2 Ransomware" . Vos fichiers ne sont pas perdus, c’est possible de les récupérer et les avoir à l’état normal en les décryptant. La seule façon de le faire et en ayant le logiciel "SAGE Decrypter" et votre clé de décryptage. En utilisant un autre logiciel qui prétend pouvoir restaurer vos fichiers va endommager et détruir vos fichiers. Vous pouvez acheter le logiciel "SAGE Decrypter" et votre clé de décryptage sur votre profile auquel vous pouvez accéder en cliquant sur ce lien: http://7gie6ffnkrjykggd.3io74zx.com/ Si vous êtes demandé de fournir votre clé, copiez la dans le formulaire du site. Voici votre clé personnelle: ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA Vous serez en mesure de décrypter un fichier gratuitement pour être sûre que le logiciel "SAGE Decrypter" est capable de restaurer vos fichiers Si aucun des liens ne marche pour vous pour une période prolongée ou si vous avez besoin de restaurer vos fichiers rapidement, vous pouvez accéder à votre profile en utilisant "Navigateut Tor". Pour le faire vous devez: Ouvrez Explorer ou n’importe quel autre navigateut; Copiez cette addresse https://www.torproject.org/download/download-easy.html.en dans la barre d’adresse et cliquez sur "Enterer"; Une fois que la page est ouverte, on va vous proposer de télécharger le navigateur Tor, Téléchargez-le et lancez l’installation, suivez les instructions d’installation ; Une fois l’installation faite, ouvrez votre nouveau navigateur Tor et appuyez sur le bouton "Connect" (Le bouton peut être nommé différemment si vous n’avez pas installé la version en anglais); Le navigateur Tor va établir une connection et ouvrir une fenêtre ordinaire de navigateur ; copiez l’adresse http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA dans la barre d’adresse et cliquez sur "Entrer"; Votre profile doit être ouvert maintenant; si ça ne marche pas attendez puis essayez encore une fois. Si vous n’arrivez pas à suivre ces étapes verifies alors votre connexion internet et réessayez. Si ça ne march
URLs
-
http://7gie6ffnkrjykggd.3io74zx.com/
-
http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA
-
http://7gie6ffnkrjykggd.onion/login/ARf-EFwuLjVzdRxWJiDH2ynRGM8GghhSmMpycPT1b7kKthcNtyrvKjjA到浏览器的地址栏，然后按下"回车"键；
Signatures
- Family: Sage
Sage is a ransomware that has been active since 2020.
- Contacts a large (7704) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Executes dropped EXE 4 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies Control Panel 1 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 16 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.pf.exe" g2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "TcQa8DUi" /TR "C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe"C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe"2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe"C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe" g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /DELETE /TN /F "TcQa8DUi"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config16184093.bat"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exeC:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe"C:\Users\Admin\AppData\Roaming\HnCYIOJ5.exe" g2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
__config16184093.bat
__config252888.bat
f1.vbs
GU7WeCi7.tmp
HnCYIOJ5.exe
!HELP_SOS.hta
FormatRegister.ico...
UnlockUninstall.aif.sage
memory/236-31-0x0000000000400000-0x000000000044D000-memory.dmp
memory/236-29-0x0000000000400000-0x000000000044D000-memory.dmp
memory/824-22-0x0000000000400000-0x000000000044D000-memory.dmp
memory/824-8-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-12-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-13-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-15-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-14-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-16-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-17-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-18-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-19-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-21-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-20-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-1-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-0-0x0000000002570000-0x00000000025F0000-memory.dmp
memory/824-26-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-10-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-9-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-11-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-2-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-3-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-36-0x0000000000400000-0x000000000044D000-memory.dmp
memory/824-7-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-4-0x0000000002570000-0x00000000025F0000-memory.dmp
memory/824-5-0x0000000002350000-0x0000000002351000-memory.dmp
memory/824-6-0x0000000002350000-0x0000000002351000-memory.dmp
memory/3472-33-0x0000000000400000-0x000000000044D000-memory.dmp
memory/3472-32-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5164-42-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5164-44-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5320-38-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5320-25-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5568-43-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5568-45-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5568-39-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5568-345-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5568-368-0x0000000000400000-0x000000000044D000-memory.dmp