cybergate | 72a7b98df7e238b2dd4bcd91ad1350c021724437d1476914999ee4163ed80256

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Size

223KB
MD5

f8cd90273c440357a5f9f8ee6b3c7c78
SHA1

2e85c539f4829ab1ce991c007b26ea96061c79ef
SHA256

72a7b98df7e238b2dd4bcd91ad1350c021724437d1476914999ee4163ed80256
SHA512

2ebd128abc10dd81b018d633518844569dbe7867ea149be13e7b9057eb1b1a5c0ceaac9c091923b661759c75f6c9d24cebbf23ab7e6a3165ba6c54e7db130f01
SSDEEP

6144:wb0tCeLEdfoM6+/iXyrr/5UteUiUtCJHMqsEjR55j30s03NkLIiuTfir:htCeLEdfoM6+/iXyrr/5hNsI5qDafuTS

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.2.3

Botnet

vítima

yass123.no-ip.biz:3460

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\dir\\install\\install\\server.exe Restart"	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5092-2-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5092-4-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5092-6-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5092-10-0x0000000024010000-0x000000002404E000-memory.dmp	upx
behavioral2/memory/5092-58-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/4620-62-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/5092-63-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4620-64-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/4620-67-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/4620-69-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/4620-70-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/4620-76-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/4620-77-0x0000000024050000-0x000000002408E000-memory.dmp	upx
behavioral2/memory/4620-109-0x0000000024050000-0x000000002408E000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description pid process target process

PID 4744 set thread context of 5092 4744 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid process

5092 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
5092 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid process

4620 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4620 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Token: SeDebugPrivilege 4620 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid process

4744 f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	pid	process	target process
PID 4744 set thread context of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid	process
5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid	process
4620	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4620	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
Token: SeDebugPrivilege	4620	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

pid	process
4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exef8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe

description	pid	process	target process
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 4744 wrote to memory of 5092	4744	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe
PID 5092 wrote to memory of 4828	5092	f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744

C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:4828

C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8cd90273c440357a5f9f8ee6b3c7c78_JaffaCakes118.exe"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UuU.uUu
Filesize
8B

MD5
178065b7f215aa4fd9c505396c95f90f

SHA1
82553927231394ad947fdcc21c1277ce21e328a6

SHA256
f22dfe6476f57ffe4c0cede5ec1ff024a4d809cd79afcdf60ed4bfe611e7d75e

SHA512
384294a92d19f75daf866ced5ced9d275efc9dae7cca97eaad86313dad35d2ebf17ba971f4c5ee46c892c96e416d1ac43e67a73f8273bc06df7f32c0b4b8e425

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
141KB

MD5
d8f89c333d8e68956a48dcb359f34c59

SHA1
1529d7617d233e0bca3717786b653e2e57ff5ec1

SHA256
137ee123ff6a4cef5bdfc30e10df402ec0f85db59b3e2f35d1d34d6861c4959e

SHA512
95b5347f8a055df16c9700fe0bfd59ce00fbb13fa39683e5320b016e0e18d4190e008e29d53265777be9e03f1a7619530116918abd55289eecbd2c544f2c1298

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat
Filesize
15B

MD5
86f3c87caff4d7973404ff22c664505b

SHA1
245bc19c345bc8e73645cd35f5af640bc489da19

SHA256
e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb

SHA512
0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024

Download Submit
memory/4620-64-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/4620-77-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/4620-15-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/4620-109-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/4620-61-0x0000000003D10000-0x0000000003D11000-memory.dmp

Filesize
4KB

Download
memory/4620-62-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/4620-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4620-76-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/4620-67-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/4620-70-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/4620-69-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download
memory/5092-10-0x0000000024010000-0x000000002404E000-memory.dmp

Filesize
248KB

Download
memory/5092-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5092-63-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5092-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5092-4-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5092-58-0x0000000024050000-0x000000002408E000-memory.dmp

Filesize
248KB

Download