cybergate | c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5

Analysis

max time kernel
189s
max time network
113s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe
Size

743KB
MD5

671379a24c0fa396444481d18d7f7a91
SHA1

1fb8d5f156abc31aaf659f9e4f772e9d99e78eab
SHA256

c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5
SHA512

4fb4464fc4127d78b127c248deea50e69e71176f24d301cabd71f0a536ebd17679abe9cbc52299d444f90f0c6811a0aa5b465931cf5d25363a975c3007a44b8a
SSDEEP

12288:5nNhuBoY8SorxgmA+nlvVlEyJqcwwQlSWAu0pybGK+Ruson8F7c320wVOh5WCK/y:5PatCg7EPayJqcX7W00bGHPon8FI/wm7

Score

10^/10

cybergate megahac persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

megahac

megahac.sytes.net:1380

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
explorer
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
463d2f
regkey_hkcu
win32
regkey_hklm
win32

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 3 IoCs

pid	Process
1460	GC.EXE
1420	SERVER.EXE
560	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8O1754O8-XS28-6Y5O-SW0O-4GG064Q28MP3}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8O1754O8-XS28-6Y5O-SW0O-4GG064Q28MP3}\StubPath = "C:\\Program Files (x86)\\explorer\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8O1754O8-XS28-6Y5O-SW0O-4GG064Q28MP3}	SERVER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8O1754O8-XS28-6Y5O-SW0O-4GG064Q28MP3}\StubPath = "C:\\Program Files (x86)\\explorer\\server.exe Restart"	SERVER.EXE

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1508-55-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/memory/1508-74-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral1/files/0x000a0000000122f2-77.dat	upx
behavioral1/files/0x000a0000000122f2-79.dat	upx
behavioral1/files/0x000a0000000122f2-82.dat	upx
behavioral1/memory/1420-84-0x0000000000400000-0x0000000000465000-memory.dmp	upx
behavioral1/files/0x000a0000000122f2-86.dat	upx
behavioral1/memory/1420-88-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1420-97-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1780-102-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1780-104-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1420-109-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1892-114-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1420-115-0x0000000000400000-0x0000000000465000-memory.dmp	upx
behavioral1/memory/1892-116-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/files/0x0009000000012302-118.dat	upx
behavioral1/files/0x0009000000012302-119.dat	upx
behavioral1/files/0x0009000000012302-120.dat	upx
behavioral1/files/0x0009000000012302-122.dat	upx
behavioral1/memory/1892-124-0x0000000003900000-0x0000000003965000-memory.dmp	upx
behavioral1/memory/560-126-0x0000000000400000-0x0000000000465000-memory.dmp	upx
behavioral1/memory/560-128-0x0000000000400000-0x0000000000465000-memory.dmp	upx
behavioral1/memory/1780-129-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1892-130-0x00000000240F0000-0x0000000024152000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe
2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe
2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe
1892	explorer.exe
1892	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	SERVER.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Program Files (x86)\\explorer\\server.exe"	SERVER.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	SERVER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Program Files (x86)\\explorer\\server.exe"	SERVER.EXE

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1508-55-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral1/memory/1508-74-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1508 set thread context of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\explorer\server.exe	SERVER.EXE
File opened for modification	C:\Program Files (x86)\explorer\server.exe	SERVER.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1420	SERVER.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1892	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	explorer.exe
Token: SeDebugPrivilege	1892	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1420	SERVER.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 1508 wrote to memory of 2000	1508	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	28
PID 2000 wrote to memory of 1460	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	29
PID 2000 wrote to memory of 1460	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	29
PID 2000 wrote to memory of 1460	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	29
PID 2000 wrote to memory of 1460	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	29
PID 2000 wrote to memory of 1420	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	30
PID 2000 wrote to memory of 1420	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	30
PID 2000 wrote to memory of 1420	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	30
PID 2000 wrote to memory of 1420	2000	c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe	30
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9
PID 1420 wrote to memory of 1244	1420	SERVER.EXE	9

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe
  "C:\Users\Admin\AppData\Local\Temp\c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Users\Admin\AppData\Local\Temp\c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe
    "C:\Users\Admin\AppData\Local\Temp\c676aa1538b4c90343753ef45ae79dd53cfe62bc2afa16f3e98a2c34df5cc0f5.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\GC.EXE
      "C:\Users\Admin\AppData\Local\Temp\GC.EXE"
      4⤵
      Executes dropped EXE
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\SERVER.EXE
      "C:\Users\Admin\AppData\Local\Temp\SERVER.EXE"
      4⤵
      Executes dropped EXE
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        Modifies Installed Components in the registry
        
        PID:1780
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        Loads dropped DLL
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
      - C:\Program Files (x86)\explorer\server.exe
        
        "C:\Program Files (x86)\explorer\server.exe"
        6⤵
        Executes dropped EXE
        
        PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\explorer\server.exe

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
C:\Program Files (x86)\explorer\server.exe

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GC.EXE

Filesize
156KB

MD5
793b4db2716db9cd85a373d5f037c470

SHA1
9c83fcdaf8f711d39d1e58ad2173c3cc94a575e6

SHA256
19f1e3a00e2c281c0a5f42652d1edca6769fc929e77ac59c4dc3d2aee7662b0d

SHA512
7bdff3755003e95f94ac99c29a180ee601626d2167200fee89e315a92127f55a04f1ab2244f0ff4e0e2fcf739ca75f063fab26bb9c827894bab7a984188fc0f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GC.EXE

Filesize
156KB

MD5
793b4db2716db9cd85a373d5f037c470

SHA1
9c83fcdaf8f711d39d1e58ad2173c3cc94a575e6

SHA256
19f1e3a00e2c281c0a5f42652d1edca6769fc929e77ac59c4dc3d2aee7662b0d

SHA512
7bdff3755003e95f94ac99c29a180ee601626d2167200fee89e315a92127f55a04f1ab2244f0ff4e0e2fcf739ca75f063fab26bb9c827894bab7a984188fc0f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\SERVER.EXE

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\SERVER.EXE

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
9c5e974c98a7d827f72bd02d34b4de54

SHA1
395c363b048c7363b428d096256204958da87008

SHA256
8c48563f3a0489c495e7ccdaefc032a226d9c53469cdb4809b5921d93dae5149

SHA512
2980c6127ffd6988d3f987b175605028387d58e024b144194a94b1dc3223ed3b33169a63c704018053531c4978b2b85f4dd06456f19a45820a31e165fb5d982f

Download Submit
\Program Files (x86)\explorer\server.exe

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
\Program Files (x86)\explorer\server.exe

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
\Users\Admin\AppData\Local\Temp\GC.EXE

Filesize
156KB

MD5
793b4db2716db9cd85a373d5f037c470

SHA1
9c83fcdaf8f711d39d1e58ad2173c3cc94a575e6

SHA256
19f1e3a00e2c281c0a5f42652d1edca6769fc929e77ac59c4dc3d2aee7662b0d

SHA512
7bdff3755003e95f94ac99c29a180ee601626d2167200fee89e315a92127f55a04f1ab2244f0ff4e0e2fcf739ca75f063fab26bb9c827894bab7a984188fc0f2

Download Submit
\Users\Admin\AppData\Local\Temp\SERVER.EXE

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
\Users\Admin\AppData\Local\Temp\SERVER.EXE

Filesize
296KB

MD5
b7573a514f192367be8e14dc56533e3d

SHA1
fe0ea08d9d4e8b9ab4d10a77e39a532591541db6

SHA256
7949549cd09abcb7629a5fd573291be5bd6e7fcda1f268a3e072ce067016d447

SHA512
a7f76c638f08f894c5265959abfcb1819bfb4c91dd4fe9ef2c457a809d520d7977fbf1884b7a72694e7b5ef706d1787d24beca09d8c4cb7b5daf3e6e171976d2

Download Submit
memory/560-126-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/560-128-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1244-91-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1420-115-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1420-97-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1420-84-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1420-88-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1420-109-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1460-127-0x0000000004DF5000-0x0000000004E06000-memory.dmp

Filesize
68KB

Download
memory/1460-85-0x0000000000AE0000-0x0000000000B0E000-memory.dmp

Filesize
184KB

Download
memory/1508-74-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1508-71-0x0000000003C80000-0x0000000003D16000-memory.dmp

Filesize
600KB

Download
memory/1508-55-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1508-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1780-96-0x0000000073A31000-0x0000000073A33000-memory.dmp

Filesize
8KB

Download
memory/1780-102-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1780-104-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1780-129-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1892-125-0x0000000003900000-0x0000000003965000-memory.dmp

Filesize
404KB

Download
memory/1892-114-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1892-130-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1892-116-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1892-131-0x0000000003900000-0x0000000003965000-memory.dmp

Filesize
404KB

Download
memory/1892-132-0x0000000003900000-0x0000000003965000-memory.dmp

Filesize
404KB

Download
memory/1892-124-0x0000000003900000-0x0000000003965000-memory.dmp

Filesize
404KB

Download
memory/2000-57-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-59-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-61-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-56-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-62-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-64-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-66-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-70-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-81-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2000-72-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download