cybergate | be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb

Analysis

max time kernel
221s
max time network
228s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
Size

995KB
MD5

fec2f67c261edfb07ae184e163317704
SHA1

56edabab5646c6d9316879396013550b87b54f85
SHA256

be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb
SHA512

2759b059544ba5b3c7d89c025f2552bed434b5405cbfb8ecff240d2b389295b423d08fc238842b4509590bad1bad8bc25d1e1442a0344f757d4d9601e7c75670
SSDEEP

24576:Ws3RNNThFOfRDt0x62p0DJChree1tog5uQoDb0:WShFet0x62SD2I0

Score

10^/10

cybergate victim evasion persistence stealer themida trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

victim

127.0.0.1:81

black-soul.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
Win_Xp.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Please try again later.
message_box_title
Error
password
otm001
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 1 IoCs

pid	Process
1596	Win_Xp.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{635HBU63-KQDY-Q5P5-VPK5-7H2383655D8V}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{635HBU63-KQDY-Q5P5-VPK5-7H2383655D8V}\StubPath = "c:\\windows\\system32\\microsoft\\Win_Xp.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{635HBU63-KQDY-Q5P5-VPK5-7H2383655D8V}	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{635HBU63-KQDY-Q5P5-VPK5-7H2383655D8V}\StubPath = "c:\\windows\\system32\\microsoft\\Win_Xp.exe Restart"	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/576-58-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/576-69-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/932-74-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/576-78-0x0000000004460000-0x00000000044C2000-memory.dmp	upx
behavioral1/memory/576-84-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1748-89-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1748-91-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/932-92-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1748-102-0x00000000240F0000-0x0000000024152000-memory.dmp	upx

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine	Win_Xp.exe

Loads dropped DLL 2 IoCs

pid	Process
1748	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
1748	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

Themida packer 13 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/576-54-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/memory/576-56-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/memory/576-67-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/memory/576-68-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/files/0x00090000000126d7-81.dat	themida
behavioral1/memory/576-90-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/memory/1748-93-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/files/0x00090000000126d7-94.dat	themida
behavioral1/files/0x00090000000126d7-95.dat	themida
behavioral1/files/0x00090000000126d7-97.dat	themida
behavioral1/memory/1596-98-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/memory/1596-100-0x0000000000400000-0x00000000005D3000-memory.dmp	themida
behavioral1/memory/1596-101-0x0000000000400000-0x00000000005D3000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\windows\\system32\\microsoft\\Win_Xp.exe"	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\windows\\system32\\microsoft\\Win_Xp.exe"	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\microsoft\Win_Xp.exe	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
File opened for modification	\??\c:\windows\SysWOW64\microsoft\	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
File created	\??\c:\windows\SysWOW64\microsoft\Win_Xp.exe	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
File opened for modification	\??\c:\windows\SysWOW64\microsoft\Win_Xp.exe	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
1596	Win_Xp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
1596	Win_Xp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1748	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
Token: SeDebugPrivilege	1748	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13
PID 576 wrote to memory of 1232	576	be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
  "C:\Users\Admin\AppData\Local\Temp\be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
    "C:\Users\Admin\AppData\Local\Temp\be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
  - - C:\windows\SysWOW64\microsoft\Win_Xp.exe
      "C:\windows\system32\microsoft\Win_Xp.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
bb46d391ed52d8fafda791af98c0331b

SHA1
fd37e0ccb18eda85a31e5713fd3b796a5a17623f

SHA256
fd2353cd3afbd0b6fcd113a2297472f743ca339072dcd59e872966b03608f301

SHA512
bbf3620972602ecbfef7e44dc0b46db8787b4659ec2fc3b7a35807cae4f53abbcb352f72447642d9d8fdac209204e9e6e1bfd290b4a669e8504d4b2e8208a2c0

Download Submit
C:\Windows\SysWOW64\microsoft\Win_Xp.exe

Filesize
995KB

MD5
fec2f67c261edfb07ae184e163317704

SHA1
56edabab5646c6d9316879396013550b87b54f85

SHA256
be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb

SHA512
2759b059544ba5b3c7d89c025f2552bed434b5405cbfb8ecff240d2b389295b423d08fc238842b4509590bad1bad8bc25d1e1442a0344f757d4d9601e7c75670

Download Submit
\??\c:\windows\SysWOW64\microsoft\Win_Xp.exe

Filesize
995KB

MD5
fec2f67c261edfb07ae184e163317704

SHA1
56edabab5646c6d9316879396013550b87b54f85

SHA256
be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb

SHA512
2759b059544ba5b3c7d89c025f2552bed434b5405cbfb8ecff240d2b389295b423d08fc238842b4509590bad1bad8bc25d1e1442a0344f757d4d9601e7c75670

Download Submit
\Windows\SysWOW64\microsoft\Win_Xp.exe

Filesize
995KB

MD5
fec2f67c261edfb07ae184e163317704

SHA1
56edabab5646c6d9316879396013550b87b54f85

SHA256
be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb

SHA512
2759b059544ba5b3c7d89c025f2552bed434b5405cbfb8ecff240d2b389295b423d08fc238842b4509590bad1bad8bc25d1e1442a0344f757d4d9601e7c75670

Download Submit
\Windows\SysWOW64\microsoft\Win_Xp.exe

Filesize
995KB

MD5
fec2f67c261edfb07ae184e163317704

SHA1
56edabab5646c6d9316879396013550b87b54f85

SHA256
be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb

SHA512
2759b059544ba5b3c7d89c025f2552bed434b5405cbfb8ecff240d2b389295b423d08fc238842b4509590bad1bad8bc25d1e1442a0344f757d4d9601e7c75670

Download Submit
memory/576-84-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/576-55-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/576-67-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/576-68-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/576-69-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/576-54-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/576-78-0x0000000004460000-0x00000000044C2000-memory.dmp

Filesize
392KB

Download
memory/576-58-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/576-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/576-56-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/932-74-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/932-66-0x0000000074B31000-0x0000000074B33000-memory.dmp

Filesize
8KB

Download
memory/932-92-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1232-61-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1596-98-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1596-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1596-101-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1748-93-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1748-91-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1748-89-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1748-102-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1748-103-0x0000000006690000-0x0000000006863000-memory.dmp

Filesize
1.8MB

Download