cybergate | 3ab988be7998e549c715655fbff6cdee13208add6b73d3face87b6e93332deab

Analysis

max time kernel
147s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
Size

1.0MB
MD5

64a73bb6ad9ffe6ffe9472eb6f0efea9
SHA1

f5b51d0250ca3cb0f445bbffc83fa072f4e0f4f1
SHA256

3ab988be7998e549c715655fbff6cdee13208add6b73d3face87b6e93332deab
SHA512

2e23d2754dfb6869f9f24e485485002db0183f337ef5a71fda73ea67711bd7c5daec2ff2e1f53098ff20c8348b32169f6c2d992092da61f9040641e9b4ba216c
SSDEEP

24576:+isEYsQjgklCftc8sIixmZqF2h6ctsOhIcY:tLBQjgkc2Ii72Ec/yc

Score

10^/10

cybergate remote persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

fahad-vip.zapto.org:999

Mutex

601Y7C26116N10

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAN0OD0O-7847-76MM-03EQ-OL44258H7IQ1}	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAN0OD0O-7847-76MM-03EQ-OL44258H7IQ1}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAN0OD0O-7847-76MM-03EQ-OL44258H7IQ1}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DAN0OD0O-7847-76MM-03EQ-OL44258H7IQ1}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

Deletes itself 1 IoCs

pid	Process
2380	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
1680	server.exe
2232	server.exe

Loads dropped DLL 2 IoCs

pid	Process
2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2452-3-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2452-7-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2452-8-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2452-9-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1448-544-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/2380-839-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral1/memory/2452-854-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2232-867-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2232-872-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/1448-873-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/2380-874-0x00000000104F0000-0x0000000010555000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\server.exe	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\install\	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1680 set thread context of 2232	1680	server.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
2232	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	1448	explorer.exe
Token: SeRestorePrivilege	1448	explorer.exe
Token: SeBackupPrivilege	2380	explorer.exe
Token: SeRestorePrivilege	2380	explorer.exe
Token: SeDebugPrivilege	2380	explorer.exe
Token: SeDebugPrivilege	2380	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
1680	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 1936 wrote to memory of 2452	1936	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	28
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15
PID 2452 wrote to memory of 1188	2452	64a73bb6ad9ffe6ffe9472eb6f0efea9.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
  "C:\Users\Admin\AppData\Local\Temp\64a73bb6ad9ffe6ffe9472eb6f0efea9.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\64a73bb6ad9ffe6ffe9472eb6f0efea9.exe
    "C:\Users\Admin\AppData\Local\Temp\64a73bb6ad9ffe6ffe9472eb6f0efea9.exe"
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      Suspicious use of AdjustPrivilegeToken
      PID:1448
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Deletes itself
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\SysWOW64\install\server.exe
      "C:\Windows\system32\install\server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:1680
    - - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\SysWOW64\install\server.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
bf0d340afebb1408d2909c70eea77732

SHA1
3a1910be2bae5df52a325ffdc96cfba6faae9a40

SHA256
21335ed60128e6588eb1e2e09a501f3bd262e055f321027fc2507d421fac2107

SHA512
92ea76b8db4f6f912ce87d596396e5fc8eb02de1e45b28935864668384e0d6d2712efe5ccd5841e2b84126f545c592155432fe8fb7235ac17e729302b776258f

Download Submit
C:\Users\Admin\AppData\Roaming\Adminlog.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
539KB

MD5
94cc0a79d325edbe39df054b5ba62dd2

SHA1
6e00c6aed1b68a040a4af5d680f49d6cc84d7cf6

SHA256
cb8b4dd0e06798ad80fdd3b47cab733388b79cb4a51a29f78abfecdd7ec67f29

SHA512
92b199bea8d41f2f20f83878ec428d87d692bede0d10a2f5c14359cd095f76cd74dc1fe6dbf6e969fa4273e5dc7adc05ca477b0ea96466e5888f25165d1f0bfb

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
405KB

MD5
9e05f2ce1fab5b5017fce33d5136230c

SHA1
d2b711a9e541e45b664c255be631d3c83e3f4b4c

SHA256
a619987ba2d3552595c337896b2a3d13c5561a39f5dc16045628271c29c4dc86

SHA512
ab373789dcb7ecb445d138fbea50d49c07b928fafa6389e867e3c8f1abc7ea637fddf560ee31110f37ce97db4bd6280428fc4c846239a39d4d1ab15dba98f0ba

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
156KB

MD5
53da1e81dae600fa973e669c0176c5f4

SHA1
c7ab91bf4bfdcd42dd0d0665c5f153794a139f3f

SHA256
164a53c150d8b6ad2b522379b604a6054d19c8aeb48efb134b63a1ee132fa5ef

SHA512
f2b8c2b27fea1e3cfb9fa7a4cd33267bfb19a2505b6353b8216768bfdbe1d9545b33738224f6d691a8a4389432153b02e1c659ea965e2feeed596716f7580a32

Download Submit
\Windows\SysWOW64\install\server.exe

Filesize
485KB

MD5
53ad552381b0ad26314196374a0c4be7

SHA1
8d47114e457cb11e216bc552ea1772423a3fd23a

SHA256
aa28c16d19cb9b2a9a1b282edde57d681c1ae97ca7bc83e07afe2664e35550c7

SHA512
6472f3b7490f83b28aa9a7f89468af9ff39b91f8ad581f8ba0725443a38763c94c634fe7bbf28f6e1c8b9fabe44e7ce08ac1340450468b9fac6fa2474c1a32f9

Download Submit
\Windows\SysWOW64\install\server.exe

Filesize
369KB

MD5
5e0455cb3a16a9f21fdcb1336d19bc18

SHA1
05a7e749d762e3aacff420025715a32352c2cd01

SHA256
31fc0ed25a9b598a66ef6baf5fa906327010b01ae65dc6eb57636104ad39da30

SHA512
009a488e49c6e34132564eb3b9a41684936ac5bb7ac55458366ac6f9c1225c83fd84d26cf8acc820f1d7c8a5e37df21b2251bd4565206ed43311a46bad85c46a

Download Submit
memory/1188-13-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1448-314-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1448-544-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1448-873-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1448-256-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1680-869-0x0000000000400000-0x00000000009B8000-memory.dmp

Filesize
5.7MB

Download
memory/1680-858-0x0000000000400000-0x00000000009B8000-memory.dmp

Filesize
5.7MB

Download
memory/1936-6-0x0000000000400000-0x00000000009B8000-memory.dmp

Filesize
5.7MB

Download
memory/1936-0-0x0000000000400000-0x00000000009B8000-memory.dmp

Filesize
5.7MB

Download
memory/1936-4-0x0000000003D40000-0x00000000042F8000-memory.dmp

Filesize
5.7MB

Download
memory/2232-872-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2232-867-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2380-839-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/2380-874-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/2452-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2452-7-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2452-857-0x0000000002BB0000-0x0000000003168000-memory.dmp

Filesize
5.7MB

Download
memory/2452-8-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2452-854-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2452-9-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2452-875-0x0000000002BB0000-0x0000000003168000-memory.dmp

Filesize
5.7MB

Download