Overview

overview

10

Static

static

10

2a0eac4a29...18.exe

windows7-x64

10

2a0eac4a29...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 03:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

  • Size

    2.4MB

  • MD5

    2a0eac4a29193e4974fc62d0563132c8

  • SHA1

    56fa794365db835a07d66a58f8b9b3e245b351eb

  • SHA256

    2c08ff6a35203fb39f4f01b267d2e37ee7d3858114b90c0e5a676c24ef19cb7c

  • SHA512

    719b749e1a95762ccacf153cf8bd3f81d20c31e8f42842d397c6c9c50f6664e1d21f227033a013214c435b497335557cd09507c29cb8206c5bde5eae26b50f23

  • SSDEEP

    49152:bS6CjZMSsu5Ky1MzzgfnpNYyrODlP7expD+ger3NKwmBIMJ/4xieOi3klBhCE2:b0jZMSsu5ziiXeZ7exp1C3NBPMJ/4xVL

Score
10/10
cybergatevítimadiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

ghost77.no-ip.biz:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3368
      • C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3664
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:4684
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:3432
          • C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:676
            • C:\Users\Admin\AppData\Local\Temp\SpyNet.exe
              "C:\Users\Admin\AppData\Local\Temp\SpyNet.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks SCSI registry key(s)
              • Checks processor information in registry
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1660
              • C:\Windows\SysWOW64\cscript.exe
                "C:\Windows\system32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\teste.vbs"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3116
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4920
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 556
                5⤵
                • Program crash
                PID:4320
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4920 -ip 4920
        1⤵
          PID:3728

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Language\Default.ini
          Filesize

          14KB

          MD5

          ee9826fd3883b9756896baed5d076cc6

          SHA1

          d1c829cabcb967410e03489723d9e51b9549d6f6

          SHA256

          e06ff3e2b4cf78d6147d00dbfd00066751d1d6680b3dd672e861574741a894d9

          SHA512

          404cfe3632fc3614a0e686504a2edcdf984aab20afc8fc4c7785d76bd52bf466078e756838c2ce5350439ad128756e55e1c3b12f3badd70fba8e74d171a05538

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Settings\Settings.ini
          Filesize

          1KB

          MD5

          448a49c2d7253c927e820056e9e7ea8b

          SHA1

          c7171c7b597beea4bb584319ddac80eadee5d3be

          SHA256

          afcc1b53d0e2ef177754d4f6ae9ab391e7115e39fc73caaabcb3cd585c2e4c7c

          SHA512

          54dc9c1eba0154aa648ec317c51642fd88d7dcd50b4e5f1eea5c67e1c7db91a7e8cb97d0b538e4a280d91a65fea8baa888734960fbf636b7067ac407840a5224

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\SpyNet.exe
          Filesize

          2.0MB

          MD5

          98de7bcad1ba2caf74007bd97bc2b505

          SHA1

          8a79d06159a339313b810f23835b8417429dd356

          SHA256

          e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8

          SHA512

          ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          Filesize

          2.3MB

          MD5

          55bb672269156b92f037e5655f2a3ba5

          SHA1

          a8e6fa12f2bb254c6868ff260a2c80e7ef997292

          SHA256

          99a4ade0b349757ca342f1179a8d4ca3208c1e08cbaf936fb54d49f5f4f9041c

          SHA512

          e750ef7676010e932c652fd014d9058de45a04d81b2a642c91b104839ce0bd62817c951e80ee88f91126feab48e87172d25aa6750b54866a9409466649f50658

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          d5cd5c935266a77683139660ae6b4ae9

          SHA1

          961e731150f60266559d8f0fc10715b98575f8ce

          SHA256

          2a7269c03ff01dda24eb80b5f81b57330f73becb585e36d7438d424dc59a1138

          SHA512

          f9c750a91c4942b36829a046fb82780a2e1e14fedfa8d0631c74df2698eecd544e83d067e2f7a5653bf28b4f30eafeb430ac1310796da23eae1f135e87c52b82

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          7dad6b9ab66f4f3dd4c9f8f610bad100

          SHA1

          8a9c2eb4669305df25c75ef2e2e579eee518eb6b

          SHA256

          705905ca6562b58401015d891d3acfdcd4f623e3813c48a291b7b3e8d418c5ef

          SHA512

          f3b10a3568131988e69e90bc6e5cf12603259ca36c93a235f2b98f107e9d17fee8011a9b7780494604900dfd2670c36ccede167a3dd408fbf8022f16f4915576

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          90f6a59bfde9d71eb0faaa4151d88a63

          SHA1

          25d6ef22e1467e60658c9847e4327665cb8c2fc9

          SHA256

          b23d147a41d09cf570ca0512d12c7714628c5ecbe64becd2c7c1dfed1c164fb3

          SHA512

          dd6d756e25f7bdc8e78f5995a542ad7e14b71e079ba6fd0bd2b426d66660a2084cfeb0bb07831f068ec1fe7200a90214942dcb2ce5cdb2d35dfe6b39b0770d3b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          2b718f091b6d3bd47ca5711e23817ce3

          SHA1

          3626a7d6acd270e0500d7a2faac01d083164726f

          SHA256

          17732bc27a4343a67c11c2d659699baace449663b877c4820ee95266f231c010

          SHA512

          1cc40d26f19d4d0fe49f4b97a32e842c9e39ed1f05f6bf46877ded951e696eef66e171876cfeafc19885b7ec1d9c8787d2058243461a881e3cca02b02ae5cd2e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          63d006cf5722271299d75d5829a33974

          SHA1

          0e85e8e03e4dfb5a2a2b8dae4b956a1b19b56c1e

          SHA256

          c7eccc77f00b0e90a78c01295d83482d4e8a0a91c140d1410fc5bb98a6a79c0d

          SHA512

          228c66642c42e3d7abe99c543c65ab9662e7b74a0a696289f3e76578302f7d9da663e44b0d6d9766c65d8a1ae354766fd1f77ac0666bc45a407844a58bcff640

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          e92f6df41a5fa3a45ef6d76b9bdc60ef

          SHA1

          a32e3e159f277a637dec153a3e78f4bf0a0ac45b

          SHA256

          7120ba8ef7616ea7b3bef322b82b121019755d85401f2057af40bc90a7df6417

          SHA512

          db10de4467e6a02347035705a5027b97bf1999c4adb5a955d3a297223f18447c3a9b4f0efc5957a07800e7fda3d8ee64899a1f060b9a7f192a1be62280d5ad4e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          4347dc88aa8f952e3657b14f7a35491f

          SHA1

          7159deb7045ca9d8956d35a4dd4d3ad9f48f447d

          SHA256

          c1eafaa92f59734403d8a45be97a762084c1ee44a8173ca468bacfa736ef0a3c

          SHA512

          9c2f1c3b92448649350d0902c124640b99a9ff6cf9362a08f2de850de766c7566cc70961a353e1b74594751c5ea1cf573f98c6504c1a381691b2ef31973aaab2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          e758009ebb1b09ff90f7f1d0f1e9a15d

          SHA1

          0750f74cf60822cf9843f792aeb60e8a0b67bb0c

          SHA256

          f44121676e417167aaac4466d915c847355742a657bde5f8412b9bef755d035a

          SHA512

          ffd88b7088ea0320032ecc48191edf2c976a39a3db1515f99e4dc0fe8b10ab20ba934e4af24f82696f57cf96b06259e4d8259169911eaf8f096549ff3fac34f5

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          d81da458159b4e67795611da6689da8a

          SHA1

          22db961997a36c6711fbd577015d4c97907f6934

          SHA256

          ec3922879095eec13f43299e1ed43baf44d466492b5591ab44d42dead3ef6f8a

          SHA512

          7f641f6f130232139e0c8c26e6e300c69c8b35c39ec702c7434cb6a611375470d9c362ffe4ba1e7f169ba0af17b2e8093fc5ec251401bc2c94799d31eba78c47

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          4f49efe348d6c13eeb1902ff4d70f1da

          SHA1

          1284dad262b0a0e77d7dd97745723cb2a04e9fad

          SHA256

          89b23f06fcbbaa586e57abcc058a67f8ee2765965cecbcaf7cb840a422e00af6

          SHA512

          b0eaf2e4afa9ee728bc7b5a71ce931a47e54a5573ba6acdeedc1b2962ca4827d9d24383713e666a3cd6086f2d3aed58cecc3c61295060ac36db629589adcc428

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          74b411a66bf2879a684d14c84fb799b6

          SHA1

          ceffb44ca84f95103b4037ee9690eeaf55b90416

          SHA256

          f4043e54a10ad84ed4c4941cfbdaf15e2b928708f726101231e5e0186d66b563

          SHA512

          80ae6f4414dc7ca950a82750978fa55a46f7cfc93e7049c93f14426cfc2ac04a91e2dff8f7455c0841c35aa02b2ebc4c7595885ed6f6389929fae124c364ba9a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          94e7dfb70cde780b39c094c8556a2978

          SHA1

          8d5af1f2c8d506c95f4fdadfe251af50ee88fdee

          SHA256

          68bc659592e27dfbb6ae514590c451f3f72f41a3ad187441dec957ebf554ae83

          SHA512

          f9aad9c5cc610ccd551be800d525a079f11218de42c2340bf91ff2dc5e6fac555965986874d40bdf667ae75e63461a914fa538a0e83ba9a76e18b66c73ae4c9c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          b64d131ef67b3ffc77ae1328d8ce969d

          SHA1

          66e21f6ae5a766128bb236ab3b605c89ee6a8ac5

          SHA256

          a971f1508c5d01ab66f8467c8a998aad4fd52c03a4657fc673b6b1909fc2b32e

          SHA512

          cbe9f1804b375bf57e3be1b0e34e68e94ed36a1eda93854c7dcc57f44866118923538c4917367e5841ad0de036c934ebdfc42a123d3acff5d50e3885da06a89c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          c9143a8b23986ea1ec64d2a2ddccce6c

          SHA1

          b5e03b4be5ce647133f9917fdeda05c2d8539259

          SHA256

          fc56c3311c87a5b09ab0f74399aa96cc6845956445560ea5aea46f15c1c133a8

          SHA512

          46e442afb09266c696700a0e5e9dcd968c8681cd6966886099896c86b7a091b154ed8498812bd10d06edff36c69c34c1560f918d01685e0a05616302bc763e28

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          fadecac9c7c4811c8fdd24baadcd3fb9

          SHA1

          ec7bdfdeb8b1ec9ca74bd5611a5fa02fa6b0b7e9

          SHA256

          64fb37a6e8a75085fbee787f1672022a15820c44db182a05d4097b03be199129

          SHA512

          db650c86a564e896e01d93dc66ee03afc6b339d3b6c6339429a11c0b03c2668dafa17d0e4143ba331ce7b3800f3029bef10167587a7e9482a496c5db84086b17

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          72be15ef9a32636dcf2726bfa1191782

          SHA1

          4b19390a59a148bab5742bb4896154255b00bce6

          SHA256

          52ee6aacec6108a61e813682985d43ff28057cec9c021df6b183d7dd6631e51f

          SHA512

          0f550f955123599dac3d8066f2cddede7eb86fe109f23ee3728f3690aaf7a83ae303dc4995edf923ca146581223271d52e4c1379b7a027bad388febcd1f0c823

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          705992831d282a9751ad1942ef73e700

          SHA1

          485247fb581c858e37e58e4b2aa4ffb0fb677ffc

          SHA256

          36329e5c8cf9c074710386bd41e2eade46e135cbf15fa2e56c89e292deab375f

          SHA512

          978f04c66a3066a8f5e01c6395957d699f0da534bc4ef160a08a1b696ae396be1c68dc0e0d736d763dd076e649fd4dabfd60a7f47a10aed45a72dd08b9ba8920

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          b9c1de94491a76d01d0b8e4886f1266c

          SHA1

          c9a25c2efe002eb7fbd033ecedf70c0021073777

          SHA256

          592af013ba9ef6113c32942ebbd62a7e6acd784c5c2687f01b17567df6b2c703

          SHA512

          dc0f4e626a48ff0adc145ed1cacb49cb851d7fad0b7efdaf79de5f575b19ccddabe30e30ff260b027f73d7b2e3a7467f2d659f2dab1896cd8e096e980be9f596

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          Filesize

          8B

          MD5

          d5894d841fe78c222d8dd905be5ea62e

          SHA1

          055139daba57992de94ad6fc17fc5c1397dcc33f

          SHA256

          e3e00c50236d36b29475517302694e822ab83c561d007dd3af4c967188388a63

          SHA512

          aff78dd0b05efcf0992ae817ca3f256f6140fc1c7c29a9068f02381441256b9346243e66485cdcc64b6c89fc27713b2ae0a282394e79f1b9e6357c679a57dc57

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\teste.txt
          Filesize

          2B

          MD5

          81051bcc2cf1bedf378224b0a93e2877

          SHA1

          ba8ab5a0280b953aa97435ff8946cbcbb2755a27

          SHA256

          7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

          SHA512

          1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\teste.vbs
          Filesize

          841B

          MD5

          615964e5ab63a70f0e205a476c48e356

          SHA1

          292620321db69d57ba23fa98d2a89484ddcf83d0

          SHA256

          38a2c0e90a7c86eb5355710dd205f22f84dbba59e688cd3da6394af8c924a102

          SHA512

          69886825baf2075f8e6cdc50b0b34f92d5d06d42db4586396fb3db806fef79986ba5754c7b1251b007cde4f943efe9e3d27800dd7e15f8084fd7e7e6046c3ccc

          Download Submit

        • C:\Users\Admin\AppData\Roaming\logs.dat
          Filesize

          15B

          MD5

          e21bd9604efe8ee9b59dc7605b927a2a

          SHA1

          3240ecc5ee459214344a1baac5c2a74046491104

          SHA256

          51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

          SHA512

          42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

          Download Submit

        • C:\Windows\SysWOW64\spynet\server.exe
          Filesize

          2.4MB

          MD5

          2a0eac4a29193e4974fc62d0563132c8

          SHA1

          56fa794365db835a07d66a58f8b9b3e245b351eb

          SHA256

          2c08ff6a35203fb39f4f01b267d2e37ee7d3858114b90c0e5a676c24ef19cb7c

          SHA512

          719b749e1a95762ccacf153cf8bd3f81d20c31e8f42842d397c6c9c50f6664e1d21f227033a013214c435b497335557cd09507c29cb8206c5bde5eae26b50f23

          Download Submit

        • memory/676-1233-0x0000000024160000-0x00000000241C2000-memory.dmp

          Filesize

          392KB

          Download

        • memory/676-140-0x0000000024160000-0x00000000241C2000-memory.dmp

          Filesize

          392KB

          Download

        • memory/1660-1234-0x0000000000400000-0x0000000000957000-memory.dmp

          Filesize

          5.3MB

          Download

        • memory/1660-169-0x0000000000400000-0x0000000000957000-memory.dmp

          Filesize

          5.3MB

          Download

        • memory/3664-65-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

          Download

        • memory/3664-0-0x0000000000400000-0x00000000006CE000-memory.dmp

          Filesize

          2.8MB

          Download

        • memory/3664-4-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

          Download

        • memory/3664-24-0x0000000000400000-0x00000000006CE000-memory.dmp

          Filesize

          2.8MB

          Download

        • memory/3664-141-0x0000000000400000-0x00000000006CE000-memory.dmp

          Filesize

          2.8MB

          Download

        • memory/4684-68-0x0000000003490000-0x0000000003491000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4684-69-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

          Download

        • memory/4684-70-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

          Download

        • memory/4684-8-0x00000000004A0000-0x00000000004A1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4684-9-0x00000000009A0000-0x00000000009A1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4684-1222-0x0000000024080000-0x00000000240E2000-memory.dmp

          Filesize

          392KB

          Download

        • memory/4920-171-0x0000000000400000-0x00000000006CE000-memory.dmp

          Filesize

          2.8MB

          Download

        • memory/4920-174-0x0000000000400000-0x00000000006CE000-memory.dmp

          Filesize

          2.8MB

          Download