Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    185s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 16:55

General

  • Target

    d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba.exe

  • Size

    395KB

  • MD5

    b226710d499c34d01cd8c6c20c0dd9e3

  • SHA1

    fcfe10c8d640576753a9ddb7038fbc7112cd2f10

  • SHA256

    d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba

  • SHA512

    1b8c9093ef21bed67ae4b404959312aaa1af6f834b16da90e6b29c2f45ad28f436ca0cb90d008dd0637fdad6becda69fc60f8bfdf5f0eb363b85e25a2e328ce1

  • SSDEEP

    6144:wjOn54mixeq0dak7H6ZGdifkase6z8I2SMjYRroe4IpsQuo+4CbfVxml1:AO4QdSUdeHsIsfsHotM7+

Malware Config

Extracted

Family

cybergate

Version

2.7 J/M SE

Botnet

=P

C2

xxcc.no-ip.org:288

Mutex

JoKeR/M@SK

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    calc.exe

  • install_dir

    install

  • install_file

    windos.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:656
    • C:\Windows\system32\winlogon.exe
      winlogon.exe
      1⤵
        PID:600
        • C:\Windows\system32\fontdrvhost.exe
          "fontdrvhost.exe"
          2⤵
            PID:772
          • C:\Windows\system32\dwm.exe
            "dwm.exe"
            2⤵
              PID:1020
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p
            1⤵
              PID:764
              • C:\Windows\system32\SppExtComObj.exe
                C:\Windows\system32\SppExtComObj.exe -Embedding
                2⤵
                  PID:3652
                • C:\Windows\System32\RuntimeBroker.exe
                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                  2⤵
                    PID:4692
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    2⤵
                      PID:4488
                    • C:\Windows\System32\RuntimeBroker.exe
                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                      2⤵
                        PID:3820
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        2⤵
                          PID:3568
                        • C:\Windows\System32\RuntimeBroker.exe
                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                          2⤵
                            PID:3476
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            2⤵
                              PID:3404
                            • C:\Windows\system32\DllHost.exe
                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                              2⤵
                                PID:3304
                              • C:\Windows\system32\wbem\wmiprvse.exe
                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                2⤵
                                  PID:4512
                                • C:\Windows\System32\mousocoreworker.exe
                                  C:\Windows\System32\mousocoreworker.exe -Embedding
                                  2⤵
                                    PID:2416
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k RPCSS -p
                                  1⤵
                                    PID:884
                                  • C:\Windows\system32\fontdrvhost.exe
                                    "fontdrvhost.exe"
                                    1⤵
                                      PID:780
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                      1⤵
                                        PID:932
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                        1⤵
                                          PID:440
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                          1⤵
                                            PID:740
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                            1⤵
                                              PID:676
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                              1⤵
                                                PID:1044
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                1⤵
                                                  PID:1156
                                                  • C:\Windows\system32\taskhostw.exe
                                                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                                                    2⤵
                                                      PID:2960
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                    1⤵
                                                      PID:1028
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                      1⤵
                                                        PID:1200
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                        1⤵
                                                          PID:1224
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                          1⤵
                                                            PID:1236
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                            1⤵
                                                              PID:1376
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                              1⤵
                                                                PID:1384
                                                                • C:\Windows\system32\sihost.exe
                                                                  sihost.exe
                                                                  2⤵
                                                                    PID:2872
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                                  1⤵
                                                                    PID:1408
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                    1⤵
                                                                      PID:1536
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                      1⤵
                                                                        PID:1452
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                        1⤵
                                                                          PID:1580
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                          1⤵
                                                                            PID:1620
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
                                                                            1⤵
                                                                              PID:1632
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                              1⤵
                                                                                PID:1756
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                                1⤵
                                                                                  PID:1680
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                                                  1⤵
                                                                                    PID:1792
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                                    1⤵
                                                                                      PID:1896
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                      1⤵
                                                                                        PID:1904
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                        1⤵
                                                                                          PID:1932
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                          1⤵
                                                                                            PID:1996
                                                                                          • C:\Windows\System32\spoolsv.exe
                                                                                            C:\Windows\System32\spoolsv.exe
                                                                                            1⤵
                                                                                              PID:992
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                                                              1⤵
                                                                                                PID:2064
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                                1⤵
                                                                                                  PID:2084
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                                  1⤵
                                                                                                    PID:2176
                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                    1⤵
                                                                                                      PID:2532
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                                      1⤵
                                                                                                        PID:2572
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                        1⤵
                                                                                                          PID:2552
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalService -s W32Time
                                                                                                          1⤵
                                                                                                            PID:4704
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                            1⤵
                                                                                                              PID:3416
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                              1⤵
                                                                                                                PID:1920
                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                1⤵
                                                                                                                  PID:2868
                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                  1⤵
                                                                                                                    PID:4652
                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                    C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                    1⤵
                                                                                                                      PID:4472
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                      1⤵
                                                                                                                        PID:3232
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                        1⤵
                                                                                                                          PID:3104
                                                                                                                        • C:\Windows\Explorer.EXE
                                                                                                                          C:\Windows\Explorer.EXE
                                                                                                                          1⤵
                                                                                                                            PID:2492
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba.exe"
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:2628
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba.exe
                                                                                                                                3⤵
                                                                                                                                • Adds policy Run key to start application
                                                                                                                                • Modifies Installed Components in the registry
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:1328
                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  4⤵
                                                                                                                                  • Modifies Installed Components in the registry
                                                                                                                                  PID:4116
                                                                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:4620
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba.exe"
                                                                                                                                    4⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:1780
                                                                                                                                    • C:\Windows\SysWOW64\install\windos.exe
                                                                                                                                      "C:\Windows\system32\install\windos.exe"
                                                                                                                                      5⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      PID:116
                                                                                                                                      • C:\Windows\SysWOW64\install\windos.exe
                                                                                                                                        C:\Windows\SysWOW64\install\windos.exe
                                                                                                                                        6⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3756
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                                              1⤵
                                                                                                                                PID:2920
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                                                1⤵
                                                                                                                                  PID:2544
                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                                                  1⤵
                                                                                                                                    PID:2508
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                                                                    1⤵
                                                                                                                                      PID:2464
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                                                      1⤵
                                                                                                                                        PID:2328
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                                                                        1⤵
                                                                                                                                          PID:2316
                                                                                                                                        • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                          C:\Windows\System32\WaaSMedicAgent.exe 8e34fb7a5bc49ab3ef83392e955e1ece gp/gOsHoSkyeRznqwlD+fA.0.1.0.0.0
                                                                                                                                          1⤵
                                                                                                                                            PID:4160
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              2⤵
                                                                                                                                                PID:4352
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                              1⤵
                                                                                                                                                PID:2104
                                                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:3604
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3048

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                                                                                                                                                    Filesize

                                                                                                                                                    243KB

                                                                                                                                                    MD5

                                                                                                                                                    c5cce3dce179745deb6090efd33f8763

                                                                                                                                                    SHA1

                                                                                                                                                    365db6baff66bdd99a8f11d9cab4344b6505a03f

                                                                                                                                                    SHA256

                                                                                                                                                    13c8944fb22a20b5c81b5d0ad6d9d9ffbbe2194b86ca220cb8ecdc5b40e6eb82

                                                                                                                                                    SHA512

                                                                                                                                                    58f7a2d4bb13236b5b39b5246e4cae3177cac22bdaa16ede181e88c75c3b0d19333e6d5ada90c4869d62cbf4cebc90d39f2543830496bdde331ed5b970e18b5e

                                                                                                                                                  • C:\Windows\SysWOW64\install\windos.exe

                                                                                                                                                    Filesize

                                                                                                                                                    395KB

                                                                                                                                                    MD5

                                                                                                                                                    b226710d499c34d01cd8c6c20c0dd9e3

                                                                                                                                                    SHA1

                                                                                                                                                    fcfe10c8d640576753a9ddb7038fbc7112cd2f10

                                                                                                                                                    SHA256

                                                                                                                                                    d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba

                                                                                                                                                    SHA512

                                                                                                                                                    1b8c9093ef21bed67ae4b404959312aaa1af6f834b16da90e6b29c2f45ad28f436ca0cb90d008dd0637fdad6becda69fc60f8bfdf5f0eb363b85e25a2e328ce1

                                                                                                                                                  • C:\Windows\SysWOW64\install\windos.exe

                                                                                                                                                    Filesize

                                                                                                                                                    395KB

                                                                                                                                                    MD5

                                                                                                                                                    b226710d499c34d01cd8c6c20c0dd9e3

                                                                                                                                                    SHA1

                                                                                                                                                    fcfe10c8d640576753a9ddb7038fbc7112cd2f10

                                                                                                                                                    SHA256

                                                                                                                                                    d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba

                                                                                                                                                    SHA512

                                                                                                                                                    1b8c9093ef21bed67ae4b404959312aaa1af6f834b16da90e6b29c2f45ad28f436ca0cb90d008dd0637fdad6becda69fc60f8bfdf5f0eb363b85e25a2e328ce1

                                                                                                                                                  • C:\Windows\SysWOW64\install\windos.exe

                                                                                                                                                    Filesize

                                                                                                                                                    395KB

                                                                                                                                                    MD5

                                                                                                                                                    b226710d499c34d01cd8c6c20c0dd9e3

                                                                                                                                                    SHA1

                                                                                                                                                    fcfe10c8d640576753a9ddb7038fbc7112cd2f10

                                                                                                                                                    SHA256

                                                                                                                                                    d9d304d19b7ae78f09ea73cea5dd5c2545dc8dfa1c392fa82174952bf2d170ba

                                                                                                                                                    SHA512

                                                                                                                                                    1b8c9093ef21bed67ae4b404959312aaa1af6f834b16da90e6b29c2f45ad28f436ca0cb90d008dd0637fdad6becda69fc60f8bfdf5f0eb363b85e25a2e328ce1

                                                                                                                                                  • memory/1328-134-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/1328-142-0x0000000024010000-0x0000000024072000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/1328-139-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/1328-147-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/1328-138-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/1328-135-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/1328-140-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/1328-133-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/1328-155-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/1328-164-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/1328-160-0x0000000024160000-0x00000000241C2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/1780-163-0x0000000024160000-0x00000000241C2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/1780-166-0x0000000031770000-0x000000003177E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                  • memory/1780-169-0x0000000024160000-0x00000000241C2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/3756-180-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/3756-181-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/3756-182-0x0000000031B90000-0x0000000031B9E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                  • memory/3756-183-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/3756-184-0x0000000031B90000-0x0000000031B9E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                  • memory/3756-185-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    360KB

                                                                                                                                                  • memory/3756-186-0x0000000031B90000-0x0000000031B9E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                  • memory/4116-153-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/4116-172-0x0000000031B70000-0x0000000031B7E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB

                                                                                                                                                  • memory/4116-150-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    392KB

                                                                                                                                                  • memory/4116-187-0x0000000031B70000-0x0000000031B7E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    56KB