Analysis
-
max time kernel
167s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 06:12
Static task
static1
Behavioral task
behavioral1
Sample
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe
Resource
win7-20221111-en
General
-
Target
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe
-
Size
1.1MB
-
MD5
32c50913f5bad6c1bf3e0472dc6835a7
-
SHA1
f0f78ff7461068e336c421e59134bfb9cd866b2a
-
SHA256
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4
-
SHA512
29733e8f1e3b8ad6a0ea662668c88f626ca7aae4138ed4c2e33786ef1d1dc8bb3b69e5f666a4f09a76f8c629a7d55f853f788b3f6b6d8d1993ff63961e1fd085
-
SSDEEP
24576:9x94aSqD+WRvWjGZXUYPu2tDrbbtJ5M/A2CJ:9xSxgB6oEYmMdXM/AfJ
Malware Config
Extracted
cybergate
v3.4.2.2
1st
58.138.194.52:80
KA3TAD87D550W7
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{64H7VW0E-S1L1-K243-MR54-GP5LW2W71L70}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{64H7VW0E-S1L1-K243-MR54-GP5LW2W71L70} d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Processes:
resource yara_rule behavioral1/memory/556-78-0x0000000010410000-0x0000000010480000-memory.dmp upx behavioral1/memory/556-88-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral1/memory/1644-93-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral1/memory/1644-96-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral1/memory/1644-98-0x0000000010480000-0x00000000104F0000-memory.dmp upx -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Drops file in System32 directory 4 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exeexplorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\install\server.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe File opened for modification C:\Windows\SysWOW64\install\ d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe File opened for modification C:\Windows\SysWOW64\install\server.exe explorer.exe File created C:\Windows\SysWOW64\install\server.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exepid process 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exedescription pid process target process PID 2028 set thread context of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exed996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exepid process 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 1644 explorer.exe Token: SeDebugPrivilege 1644 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exepid process 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exepid process 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.execmd.exenet.exed996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exedescription pid process target process PID 2028 wrote to memory of 2032 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe cmd.exe PID 2028 wrote to memory of 2032 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe cmd.exe PID 2028 wrote to memory of 2032 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe cmd.exe PID 2028 wrote to memory of 2032 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe cmd.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2028 wrote to memory of 556 2028 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe PID 2032 wrote to memory of 1532 2032 cmd.exe net.exe PID 2032 wrote to memory of 1532 2032 cmd.exe net.exe PID 2032 wrote to memory of 1532 2032 cmd.exe net.exe PID 2032 wrote to memory of 1532 2032 cmd.exe net.exe PID 1532 wrote to memory of 276 1532 net.exe net1.exe PID 1532 wrote to memory of 276 1532 net.exe net1.exe PID 1532 wrote to memory of 276 1532 net.exe net1.exe PID 1532 wrote to memory of 276 1532 net.exe net1.exe PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE PID 556 wrote to memory of 1284 556 d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe"C:\Users\Admin\AppData\Local\Temp\d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc5⤵
-
C:\Users\Admin\AppData\Local\Temp\d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exeC:\Users\Admin\AppData\Local\Temp\d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
234KB
MD505fa080b61a4b7f3e71d0a88fdbe8324
SHA1e8d1ed275674d8e4213237e063ccc137ed637062
SHA2569055919330f096ad9db6497d8a4088bfe8acf00c639f401f3d72b6d109c75af7
SHA512f06f9ef888fde67150d7323c11c2d5bc6cf28ca54b447dc84d9dcf6555e2f967d8143f0a564c5df0df880623b580b5b534b1d348a8ea048110bfda9a3db5f441
-
C:\Windows\SysWOW64\install\server.exeFilesize
1.1MB
MD532c50913f5bad6c1bf3e0472dc6835a7
SHA1f0f78ff7461068e336c421e59134bfb9cd866b2a
SHA256d996440977f4174edfc6f670330ecbb4101863c2c4135a6c69e4d2dc55c58fb4
SHA51229733e8f1e3b8ad6a0ea662668c88f626ca7aae4138ed4c2e33786ef1d1dc8bb3b69e5f666a4f09a76f8c629a7d55f853f788b3f6b6d8d1993ff63961e1fd085
-
memory/276-74-0x0000000000000000-mapping.dmp
-
memory/556-87-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-62-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-58-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-61-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-97-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-63-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-64-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-66-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-67-0x0000000000409860-mapping.dmp
-
memory/556-68-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-70-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-76-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-57-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-88-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/556-60-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/556-78-0x0000000010410000-0x0000000010480000-memory.dmpFilesize
448KB
-
memory/1284-81-0x0000000010410000-0x0000000010480000-memory.dmpFilesize
448KB
-
memory/1532-71-0x0000000000000000-mapping.dmp
-
memory/1644-93-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/1644-84-0x0000000000000000-mapping.dmp
-
memory/1644-86-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/1644-96-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/1644-98-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/2028-72-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB
-
memory/2028-54-0x0000000000400000-0x00000000005C7000-memory.dmpFilesize
1.8MB
-
memory/2028-55-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/2028-73-0x0000000077C40000-0x0000000077DC0000-memory.dmpFilesize
1.5MB
-
memory/2028-75-0x00000000003F0000-0x00000000003F4000-memory.dmpFilesize
16KB
-
memory/2032-56-0x0000000000000000-mapping.dmp