Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 07:01

General

  • Target

    ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe

  • Size

    997KB

  • MD5

    22295ae123a1086892993978dfa74c50

  • SHA1

    34274142a00d1f168a95c54d7a8424469e055773

  • SHA256

    ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

  • SHA512

    280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

  • SSDEEP

    24576:KeQkTf4+DcWfmk5TyAy3iu5A3t/LIByEnywiebhPb+1GJsN:qkTggcWfmsfuW3pIByEnHNbsGK

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

darknighthacker.no-ip.biz:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:660
    • C:\Windows\system32\winlogon.exe
      winlogon.exe
      1⤵
        PID:604
        • C:\Windows\system32\fontdrvhost.exe
          "fontdrvhost.exe"
          2⤵
            PID:764
          • C:\Windows\system32\dwm.exe
            "dwm.exe"
            2⤵
              PID:1016
          • C:\Windows\system32\fontdrvhost.exe
            "fontdrvhost.exe"
            1⤵
              PID:768
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
              1⤵
                PID:940
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:424
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:1028
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                    1⤵
                      PID:1216
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1324
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                        1⤵
                          PID:1436
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                          1⤵
                            PID:1464
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              2⤵
                                PID:2452
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                              1⤵
                                PID:1660
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                1⤵
                                  PID:1768
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                  1⤵
                                    PID:1904
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                    1⤵
                                      PID:2020
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                      1⤵
                                        PID:2112
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                        1⤵
                                          PID:2224
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                          1⤵
                                            PID:2656
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                            1⤵
                                              PID:2676
                                            • C:\Windows\system32\taskhostw.exe
                                              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                                              1⤵
                                                PID:2692
                                              • C:\Windows\Explorer.EXE
                                                C:\Windows\Explorer.EXE
                                                1⤵
                                                  PID:3092
                                                  • C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe"
                                                    2⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4992
                                                    • C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe
                                                      C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe
                                                      3⤵
                                                      • Adds policy Run key to start application
                                                      • Modifies Installed Components in the registry
                                                      • Adds Run key to start application
                                                      • Drops file in System32 directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2424
                                                      • C:\Windows\SysWOW64\explorer.exe
                                                        explorer.exe
                                                        4⤵
                                                        • Modifies Installed Components in the registry
                                                        PID:448
                                                      • C:\Windows\SysWOW64\svchost.exe
                                                        "C:\Windows\System32\svchost.exe"
                                                        4⤵
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4144
                                                        • C:\Windows\SysWOW64\windows.exe
                                                          "C:\Windows\system32\windows.exe"
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:2616
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 420
                                                            6⤵
                                                            • Program crash
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3612
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 428
                                                            6⤵
                                                            • Program crash
                                                            • Checks processor information in registry
                                                            • Enumerates system info in registry
                                                            PID:1676
                                                • C:\Windows\system32\DllHost.exe
                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                  1⤵
                                                    PID:3408
                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                    1⤵
                                                      PID:3576
                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                      1⤵
                                                        PID:4832
                                                      • C:\Windows\system32\wbem\wmiprvse.exe
                                                        C:\Windows\system32\wbem\wmiprvse.exe
                                                        1⤵
                                                          PID:3488
                                                        • C:\Windows\system32\SppExtComObj.exe
                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                          1⤵
                                                            PID:3304
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                            1⤵
                                                              PID:3628
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k netsvcs -p
                                                              1⤵
                                                                PID:4968
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                1⤵
                                                                  PID:716
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                  1⤵
                                                                    PID:4676
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2616 -ip 2616
                                                                      2⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:3336
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2616 -ip 2616
                                                                      2⤵
                                                                        PID:1672
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalService -s W32Time
                                                                      1⤵
                                                                        PID:2184
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                        1⤵
                                                                          PID:5112
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                          1⤵
                                                                            PID:2420
                                                                          • C:\Windows\System32\svchost.exe
                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                            1⤵
                                                                              PID:1176
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:4404
                                                                              • C:\Windows\system32\DllHost.exe
                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                1⤵
                                                                                  PID:4420
                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                  1⤵
                                                                                    PID:3820
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:3660
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3504
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                        1⤵
                                                                                          PID:3212
                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                          1⤵
                                                                                            PID:2700
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                            1⤵
                                                                                              PID:2684
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                              1⤵
                                                                                                PID:2668
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                1⤵
                                                                                                  PID:2640
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                  1⤵
                                                                                                    PID:2516
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                    1⤵
                                                                                                      PID:2408
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                                      1⤵
                                                                                                        PID:2400
                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                                        1⤵
                                                                                                          PID:2200
                                                                                                        • C:\Windows\System32\spoolsv.exe
                                                                                                          C:\Windows\System32\spoolsv.exe
                                                                                                          1⤵
                                                                                                            PID:1816
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                                            1⤵
                                                                                                              PID:2012
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                                                              1⤵
                                                                                                                PID:1896
                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                                                1⤵
                                                                                                                  PID:1828
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
                                                                                                                  1⤵
                                                                                                                    PID:1692
                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                                                                    1⤵
                                                                                                                      PID:1624
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                                                                      1⤵
                                                                                                                        PID:1592
                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                                                                        1⤵
                                                                                                                          PID:1456
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                                                                          1⤵
                                                                                                                            PID:1416
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                                                                                            1⤵
                                                                                                                              PID:1244
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                                                                                              1⤵
                                                                                                                                PID:1204
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                                                                                                1⤵
                                                                                                                                  PID:1168
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                                                                                                                  1⤵
                                                                                                                                    PID:1036
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                                                                                                    1⤵
                                                                                                                                      PID:644
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                                                                                                      1⤵
                                                                                                                                        PID:428
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k RPCSS -p
                                                                                                                                        1⤵
                                                                                                                                          PID:880
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k DcomLaunch -p
                                                                                                                                          1⤵
                                                                                                                                            PID:780
                                                                                                                                            • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                              C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                              2⤵
                                                                                                                                                PID:1472
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                              1⤵
                                                                                                                                                PID:992
                                                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4732
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3484

                                                                                                                                                  Network

                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                                                                                                                                                          Filesize

                                                                                                                                                          240KB

                                                                                                                                                          MD5

                                                                                                                                                          69be322be5eb4b1b490fbddc06c00100

                                                                                                                                                          SHA1

                                                                                                                                                          893e3b1bccab769f3be5b46ff2a95f7cc9491510

                                                                                                                                                          SHA256

                                                                                                                                                          7ab3c9e1cbce6d67719c55a9b57e3c98aa713240bd34b3e7a8883c5b96220376

                                                                                                                                                          SHA512

                                                                                                                                                          c532bf71b9cd39d6c281e122b121a56debb5f01aaea9d4373986ceac0c9e83a54287bda71cc65a108c14ca72ba80df9c32f5b2b5e06ddbfd27f8fe11dfd5284c

                                                                                                                                                        • C:\Windows\SysWOW64\windows.exe

                                                                                                                                                          Filesize

                                                                                                                                                          997KB

                                                                                                                                                          MD5

                                                                                                                                                          22295ae123a1086892993978dfa74c50

                                                                                                                                                          SHA1

                                                                                                                                                          34274142a00d1f168a95c54d7a8424469e055773

                                                                                                                                                          SHA256

                                                                                                                                                          ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

                                                                                                                                                          SHA512

                                                                                                                                                          280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

                                                                                                                                                        • C:\Windows\SysWOW64\windows.exe

                                                                                                                                                          Filesize

                                                                                                                                                          997KB

                                                                                                                                                          MD5

                                                                                                                                                          22295ae123a1086892993978dfa74c50

                                                                                                                                                          SHA1

                                                                                                                                                          34274142a00d1f168a95c54d7a8424469e055773

                                                                                                                                                          SHA256

                                                                                                                                                          ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

                                                                                                                                                          SHA512

                                                                                                                                                          280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

                                                                                                                                                        • memory/448-324-0x0000000031BE0000-0x0000000031BED000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/448-336-0x0000000031BE0000-0x0000000031BED000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/448-334-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          392KB

                                                                                                                                                        • memory/448-307-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          392KB

                                                                                                                                                        • memory/1676-332-0x0000000031C50000-0x0000000031C5D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/2424-316-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          328KB

                                                                                                                                                        • memory/2424-296-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          328KB

                                                                                                                                                        • memory/2616-325-0x0000000031BF0000-0x0000000031BFD000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/2616-333-0x0000000031BF0000-0x0000000031BFD000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/3336-327-0x0000000031C00000-0x0000000031C0D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/3612-329-0x0000000031C20000-0x0000000031C2D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/3612-330-0x0000000031C20000-0x0000000031C2D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                        • memory/4144-317-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          392KB

                                                                                                                                                        • memory/4144-335-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          392KB

                                                                                                                                                        • memory/4992-176-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-186-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-157-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-159-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-158-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-160-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-161-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-162-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-163-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-164-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-165-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-166-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-167-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-168-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-170-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-169-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-171-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-172-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-174-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-173-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-175-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-132-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-177-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-178-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-179-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-180-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-181-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-182-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-183-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-184-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-185-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-156-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-187-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-188-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-189-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-190-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-191-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-192-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-194-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-193-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-195-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-196-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-155-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-295-0x0000000074AC0000-0x0000000075071000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          5.7MB

                                                                                                                                                        • memory/4992-154-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-153-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-151-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-152-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-150-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-149-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-148-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-147-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-146-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-145-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-144-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-143-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-141-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-142-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-140-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-139-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-136-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-138-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-137-0x0000000000BC0000-0x0000000000D62000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.6MB

                                                                                                                                                        • memory/4992-135-0x0000000074AC0000-0x0000000075071000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          5.7MB