cybergate | 89eb5aad487deeac212763db390216c91f1e4ec8a908cdcb2b6c37b82c059e2d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe
Size 964KB
Sample240822-xttjlawamp
SHA256 89eb5aad487deeac212763db390216c91f1e4ec8a908cdcb2b6c37b82c059e2d
MD5 b8ca92614a8464b07a5a01b219e7f919
SHA1 fcb72a8a80089088e65468a1ec74e31c105a144a
SHA512 24221c2682cc51c98adb2e9fb050c4ab5f9c1fbec7b8524a34ea063ca3bb161d06c0da03f99e104705d5f7d2959e56fe4c317beacd2c3d50dd741ce964a36c01
SSDEEP 6144:wvz7nMFJxDUS0JgmbLkQhOoJbu41scj9Ful+Dm:iQJxn0JgmMW1C2yoa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

blessout.no-ip.biz:82

Mutex

tyhhdf

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
rootnaw
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{IO2JYPO7-86DR-34E2-36U8-JAWC7JQF0G5Y}	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{IO2JYPO7-86DR-34E2-36U8-JAWC7JQF0G5Y}\StubPath = "C:\\Windows\\install\\server.exe Restart"	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{IO2JYPO7-86DR-34E2-36U8-JAWC7JQF0G5Y}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{IO2JYPO7-86DR-34E2-36U8-JAWC7JQF0G5Y}\StubPath = "C:\\Windows\\install\\server.exe"	explorer.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1108-6-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/1108-7-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/1108-9-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/1108-14-0x0000000024010000-0x0000000024051000-memory.dmp	upx
behavioral2/memory/1108-11-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/1108-18-0x0000000024060000-0x00000000240A1000-memory.dmp	upx
behavioral2/memory/1108-35-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/1108-64-0x0000000024060000-0x00000000240A1000-memory.dmp	upx
behavioral2/memory/2020-68-0x0000000024060000-0x00000000240A1000-memory.dmp	upx
behavioral2/memory/2020-69-0x0000000024060000-0x00000000240A1000-memory.dmp	upx
behavioral2/memory/1108-76-0x0000000024100000-0x0000000024141000-memory.dmp	upx
behavioral2/memory/1108-73-0x00000000240B0000-0x00000000240F1000-memory.dmp	upx
behavioral2/memory/1108-128-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/3284-131-0x0000000024100000-0x0000000024141000-memory.dmp	upx
behavioral2/memory/2020-150-0x0000000024060000-0x00000000240A1000-memory.dmp	upx
behavioral2/memory/3284-162-0x0000000024100000-0x0000000024141000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\server.exe"	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\server.exe"	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4024 set thread context of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\install\server.exe	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
File opened for modification	C:\Windows\install\server.exe	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3284	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3284	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
Token: SeDebugPrivilege	3284	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe
4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 4024 wrote to memory of 1108	4024	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe	85
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56
PID 1108 wrote to memory of 3408	1108	b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408
- C:\Users\Admin\AppData\Local\Temp\b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Users\Admin\AppData\Local\Temp\b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
    "C:\Users\Admin\AppData\Local\Temp\b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE
      "C:\Users\Admin\AppData\Local\Temp\b8ca92614a8464b07a5a01b219e7f919_JaffaCakes118.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UuU.uUu

Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
Size 8B
SHA256 bcc3e755b1272fdedfcb9fe29a2ac4e967cb2095e14d98f138fb8d5fa1f0dadd
MD5 9e1bad898a40a752b019b61c74f7a67a
SHA1 2b20425ecdb27ec050a2ce65b1d7e7d41030c81a
SHA512 d81742dab3c34dea53f8f5a61ae514322abc2666bb2be9d75dbd11fa45dbc51eb1e4d2536a0ff6720090878303d8abdf52ab5e7360f628e0770e11abcbce38ec
MD5 SHA1 SHA512

Submit Download

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 144KB
SHA256 217506c4fd2ae9aef385219496b39424fa628884fedf89b8fde4aa3f78a99874
MD5 871884912354e8dc2e13b32c8ace66dc
SHA1 e8270d3f78a6f5cd14cc859d3c18effaf22bff9d
SHA512 082907fc28a844f850a9ce85e091efca0bdbdf65c9eb66bc0026112600efd8d9cb4667daa70338618369043cbf30d365e9022b14a87ba81158b7d073f54d0138
SSDEEP 3072:o9ZNW7z4ipOIRF1cXM97bgg+eoHSpZMwhytbBELuob/zu:2zW7z4ipOIf1rB0+oHK+wgLE6y/zu
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3
MD5 4362e21af8686f5ebba224768d292a5b
SHA1 504510a4d10e230dcd1605ab3342525b38a10933
SHA512 f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Windows\install\server.exe
Size 964KB
SHA256 89eb5aad487deeac212763db390216c91f1e4ec8a908cdcb2b6c37b82c059e2d
MD5 b8ca92614a8464b07a5a01b219e7f919
SHA1 fcb72a8a80089088e65468a1ec74e31c105a144a
SHA512 24221c2682cc51c98adb2e9fb050c4ab5f9c1fbec7b8524a34ea063ca3bb161d06c0da03f99e104705d5f7d2959e56fe4c317beacd2c3d50dd741ce964a36c01
SSDEEP 6144:wvz7nMFJxDUS0JgmbLkQhOoJbu41scj9Ful+Dm:iQJxn0JgmMW1C2yoa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1108-64-0x0000000024060000-0x00000000240A1000-memory.dmp

Download

memory/1108-9-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1108-11-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1108-6-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1108-18-0x0000000024060000-0x00000000240A1000-memory.dmp

Download

memory/1108-128-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1108-14-0x0000000024010000-0x0000000024051000-memory.dmp

Download

memory/1108-35-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1108-73-0x00000000240B0000-0x00000000240F1000-memory.dmp

Download

memory/1108-76-0x0000000024100000-0x0000000024141000-memory.dmp

Download

memory/1108-7-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2020-19-0x00000000001A0000-0x00000000001A1000-memory.dmp

Download

memory/2020-69-0x0000000024060000-0x00000000240A1000-memory.dmp

Download

memory/2020-68-0x0000000024060000-0x00000000240A1000-memory.dmp

Download

memory/2020-67-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Download

memory/2020-20-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/2020-150-0x0000000024060000-0x00000000240A1000-memory.dmp

Download

memory/3284-131-0x0000000024100000-0x0000000024141000-memory.dmp

Download

memory/3284-162-0x0000000024100000-0x0000000024141000-memory.dmp

Download

memory/3284-232-0x0000000000400000-0x0000000000507200-memory.dmp

Download

memory/4024-0-0x0000000000400000-0x0000000000507200-memory.dmp

Download

memory/4024-10-0x0000000000400000-0x0000000000507200-memory.dmp

Download

memory/4024-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

Download