cybergate | 28cefe1482e044e72fb9c47eef92e485fb4636a87d1445e310422fc132c0e239

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Size

764KB
MD5

317ba4f10b9c3889cc66e340695d4045
SHA1

c1db48a944810a8768711986925cb9732a350635
SHA256

28cefe1482e044e72fb9c47eef92e485fb4636a87d1445e310422fc132c0e239
SHA512

4a12dfe4ab277356e404f39d665888167ca367d3832373d224b0e89920fbbc0dd2a32ed79529dea97de8c546c5ff46473f59eb8d54b3b04f948f54a8d6c2db63
SSDEEP

12288:AmjWVFwwoXcgxBIzXacdPnpwiItmb0tdAXZIEvoo6pjlQK/lGRgOUqmq9kR6lhKr:Amj4+bNCaEPnGNtf7AXZIEoo6pjlQK/N

Score

10^/10

cybergate ?????discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

?????

eto.no-ip.biz:86

Mutex

XKV04G2VA11C64

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_dir
dvnet
install_file
svchosts.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456
regkey_hkcu
dvnet
regkey_hklm
dvnet

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dvnet = "c:\\directory\\CyberGate\\dvnet\\dvnet\\svchosts.exe"	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dvnet = "c:\\directory\\CyberGate\\dvnet\\dvnet\\svchosts.exe"	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD8C83K0-4J3U-1364-4G87-M76V4JYEI6F7}\StubPath = "c:\\directory\\CyberGate\\dvnet\\dvnet\\svchosts.exe Restart"	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD8C83K0-4J3U-1364-4G87-M76V4JYEI6F7}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD8C83K0-4J3U-1364-4G87-M76V4JYEI6F7}\StubPath = "c:\\directory\\CyberGate\\dvnet\\dvnet\\svchosts.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD8C83K0-4J3U-1364-4G87-M76V4JYEI6F7}	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Executes dropped EXE 2 IoCs

pid	Process
4412	svchosts.exe
2880	svchosts.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dvnet = "c:\\directory\\CyberGate\\dvnet\\dvnet\\svchosts.exe"	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dvnet = "c:\\directory\\CyberGate\\dvnet\\dvnet\\svchosts.exe"	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4312 set thread context of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4412 set thread context of 2880	4412	svchosts.exe	88

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/376-87-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/376-88-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/376-92-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/376-95-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral2/memory/376-96-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral2/memory/376-99-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral2/memory/376-231-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2880-253-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	2880	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
Token: SeDebugPrivilege	5092	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
4412	svchosts.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 4312 wrote to memory of 376	4312	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	84
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56
PID 376 wrote to memory of 3436	376	JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      System Location Discovery: System Language Discovery
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_317ba4f10b9c3889cc66e340695d4045.exe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5092
    - - C:\directory\CyberGate\dvnet\dvnet\svchosts.exe
        
        "C:\directory\CyberGate\dvnet\dvnet\svchosts.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4412
      - C:\directory\CyberGate\dvnet\dvnet\svchosts.exe
        
        C:\directory\CyberGate\dvnet\dvnet\svchosts.exe
        6⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 532
        7⤵
        Program crash
        
        PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2880 -ip 2880
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
222KB

MD5
95d22424394610cc47ead229ab855abb

SHA1
f7adaa2a7d9163e72aacb161ae01c5fe3e104fc1

SHA256
beb7029845f7112196e8cd5d10f017ed6b10cd961559bc9ede8acbe8b71cd4df

SHA512
0a2d8919904551649c3d640f3004f03ce0be520b6382370a38bf24f892e4d9544e8ec04de9f73344c9f06ed5f2b975f0e8819435eb01d2727b58ab7e771990a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
abbeccc19187df6917168e56639bf911

SHA1
afbf475e2b11c5b722e1b8cb3099e5ee19502c70

SHA256
b6c918579a15df34ffceb18d5e39f7d31918eb89c0802778462eadf8be0d260f

SHA512
3ca8c53cc10a5ed19ffeef408101602dcac75dbd108e39ea955e5c1923ea12edeaf7b06109732a260ad307967b20eaa6542851adf3137ede70f54f481443ae1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b734e8a1748662ca1c6259418e980c64

SHA1
e378c73a01e2981d5544ff21e512d41ba45bf396

SHA256
10f73c4ab5492b5ff54e914dd836aa989d28d55b3ccb01d4fbe20388db488a18

SHA512
950dbc9e0279de855729efe267658e9f8bebe9f46445326620deaab7069b30736ec914052ac2b40a0098fb4da4b9a7be51a6df7ceec6698d34e6852baa9516fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
0ee10011c8928e8cb24937fc5447d54a

SHA1
efdd83293bc5b8938a9f3b4dc756e309d16b037b

SHA256
213de1b78345ba15e5debfa3a768d17cf607d380c855bbdd40c92c2764f29b05

SHA512
56687f4c58a4e23514f4129948cb4b6f329a1bde087f9d1300054d83ed20a6674853243d92c35791d1c879dadbe3b47257ea68b541d9b8e253c635c679d5bacd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
0408fa483cde9046da6e53e932cd2025

SHA1
a73df656023260d2464bc36f9a8f9824a6334144

SHA256
062fefba541680d73fa125c184270ced990af5bd0554440cb130ae722355ae57

SHA512
200fd8e6cbed0ec6c047b8d61700e5231f58056f3beffdd49856d413853673203e10092f7a96bfcc1b82218e5a691f7a549f8d57ea9fbb5f7eed1d469cf8f217

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
d8614576b97314d76ca8e1c2476035b0

SHA1
ff9c8815a212b35b9d36e6237796d75451cded6f

SHA256
6477b6d5aea3cc38cddd2f2f982e9e74780ad5b909861b2a13afb9b9a4904087

SHA512
60092feed9a3ff812510bf55b27c33a4e8077a040bbdbd39572139743444db0300db7344082eaf11d6f5c8a16b270589a383d1ac3d464fcf037016229730c255

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
bcb8b480b8a5f1ff807ed59d186b02cd

SHA1
5c12f3b19d4ad605ea52a780e38f75433e409f13

SHA256
2d1255bf9665153659a9c1f4f4843a2a780d76dac9887b223c6a1aede5f0f049

SHA512
a6494eda9f294642f7b3ba9008cbf71a2a81b062993229e82c26a187f94e5b14b99b5bdf8f580b90ba202bed3446e9b88fe53e3eba943d2e1fd34071e989344b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
8ab09d910c15090fabcb02b776cc57a2

SHA1
3681555916e1121536c2351fd0c0ade209a2e08c

SHA256
df4927f3ee81b18ce474bbbe36c7151d7e2c8a77a63db8d4e1b6b47df5e417c6

SHA512
e2aa9a463007e0b0692aa746297c6ee1cfe61c4da2abb766f5af748310a5cc8e089dbaf4908ab2c6441644af1e29611e03e5799144d8f9bf5ea76d050bf1bbce

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
1b4999b5097cb11210836afc9064c1e4

SHA1
5ceb07309195973893feeceb5fa2b8d52ee151c6

SHA256
1f32a3b1497c6e79a12100509ad7d7a03c9e7afb68f06acea9e0f0c3015aed4d

SHA512
03508e2429afbb0ef7cb89bd84a0a42007658ac9236d85db060191eaf7d6efb6ca922f0163fc1fd59251a05c6c319984340b23f750855cbe090c67f47113d02b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
589d5255216f777e4b852c7d5f45fa8b

SHA1
6672c4f11379d3e1a1153fceb821203d514521a9

SHA256
d9111347a333170cc2372e16a67e795339b70f57b5096b5e0f53f2b05a828bc9

SHA512
55d539d8a6b409711a5e10c4108d21f4238651bb3cae9b9c929c23aa12191ada1393190e18be6b9be89b63e170528b222d92b2e54c5cc00ef7b808bf7d772971

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
c64aed89974dd095b1ff5103f0e3c371

SHA1
f4bde9ca8dbf68e9b6427b20cf6f810f4f07965a

SHA256
bb61f763e6dd6ea296ddfeba50af64406844e3d53286e726f49e810e9d5658fd

SHA512
8698542a06dc8cf1d17a5033d378308d384f025229b68b032dbc70bff98c9b4ebbc0878183148e96af55c269c30ac869a848a528b213ca8a0d4fe40c089326ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
15895e81c51d03aea032e947d2bf23c1

SHA1
769a96fc3a43f9b73265eed7a6a79274b6af990e

SHA256
5dadd03913e702eb18c43c9c0ce723ba5abac8010cf206064cf4180a875284d3

SHA512
7dbaf8919d1578c3529f33cdaa68e82c1a490306acc5d7f3db17a99599bd06e6c2e30504d3fe17380cf763e90859e13f4e5f78fd686ef6b932805d40215ae3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2611548c3976fa12658fa63bcf3fd5cf

SHA1
945bbbd088310fde80f69007988a08edc769b2fa

SHA256
e7847f8a410deb502019738d419c7b5f3787f8a67953856e728df60e6979308e

SHA512
58516f2d4c5e5af7386b676bd7d7c0ae047ab6f72427d89ffa5a9032c0712468cb36241cd9fd1083e674796b70a128878b5951420bd3af4bbc1efa1ad1f70373

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
124b7c090b33df9b4edfd12a15ff7da6

SHA1
0985972967794799e97bd4bf92d9c8c74cb4fa3a

SHA256
285643e406ff14c176a46ae96ad604aabe6b8354194e2b5dc1a63fdde752ce6a

SHA512
95395aa269bf85e9e4985c2d5dc9fad058302ed539f9c6b44fb6b05f463f01ad4269663596ebcfea6519fddd240d58aafdcb3ef10727327d5eb062f77ee096cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f916529d07108db778095e6258bd7ef1

SHA1
56535c6bd91dbc641af065837d60331e797078e5

SHA256
1cb6bd0a8ef658b3681e084f9a75ae15824346731d0e94dfd32908f0925ddbd2

SHA512
c65b191efae3a21156cd1d9339d787c38669e9750479aea30c66fc585dca7285502688206edd771c104c14220a7920a4e00fb4270c7af65ae1af16b651faa41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
53ae7894cec06bfa32f43f6fbf609797

SHA1
5737b1442123e1be94533ef7582880d77e0bc73d

SHA256
70859505c2587b91eb1bd4c62e4b86b6caf0630948ae3f9b2748d375d7b4e254

SHA512
8e297e31155e8f9bcb1bd5260ed613db377d48a18cb043042ea5603863b52d145d5f464b497b8505b86e0fe6fdecad2efead5b0d8da2b0ffff89b82bfdfb0834

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
faabba000483b8e47d8be8366e31c0c5

SHA1
9caff319815819a358998b7be54a9629905afa92

SHA256
4783060199437ae549334fa68e1ec9b4a62a426d4385d7d4c5638f595d5f5428

SHA512
3929dd5019f001c13605338071dd36cb9620085ffb699613d305b87195e0951b6255fb6ecaf12d81367602c8bea1ceb51245861d04cd94a332ec73dda1b0ad43

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
e7ce94d43d4e8ab78f2a79967eef53e7

SHA1
e48ad8e3691f77da8a27a2541c484dc3e2470ee1

SHA256
41ca377d6deba28a68f24af26735b2c1ac25aee365d46f1c73cc3696cc819ff4

SHA512
dbf9cb3825a1c7bf3f3831fd03f0c7f26c5ef7b56b8ea9ba5c862354d2b192180bc57eaa608a440cb0cd8a02ac32b17fc4c39396b4247b57a2b2b4b83e8d38f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
43ea1c0069fa7f69a763c12ff858f0ac

SHA1
0a2bf2503dbabef43614c799151b14d6bfbb7aac

SHA256
149ddf70ce501fea7565c41ef2777b92f00746edbf3bc0d675527c00985e74bd

SHA512
a6622c2b29ac837aff0b964296cb536b0927c732600c7a8ceaee0bb058f63f856cb9513ab228682417a994f29277cc4d1eb6024fc09be79e391d5923e9efc8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
cd145f8bb09adf8729d7fe42d6ad770b

SHA1
9711a08bf8e486826762937f91e7c19a9e0529de

SHA256
52f87f1bbe7aaa0c8091978d79748dfe91a2a7763b7c175439428420c7be4fb0

SHA512
57d291b428bc6cfe4c406e2d31d0f7b7842b0d1d0aa0a1c2b93d5c7baeecd81ea31b48eb032c5c6f6fa3d3404f6d705f12ab342a7d494a14326b38b15b0f36c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
84bb8e9e5a4694a4aeaf36d8b7e1488d

SHA1
92732e2090b9299b2469fa9e20a63d1192dfafe9

SHA256
1b0b106820d0d9e368f490ef58b8ad820e57712fb55e853b5f2ffddab4990a66

SHA512
03a682396a3cf8d256deaab6c95b6e6eca3eddc1dc144140962351b0c2b49dd5e4c3b9e3463c9c673de60e0e380e671d63bc59125c1eda0bc01baf57aa65a1ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
af4876501eba7976307d39958b798b15

SHA1
3c80db203c5397256b13023d8d1829af6f1660f1

SHA256
59e66a4caae4237cb69912fcbf062a30679e788521320e000967d0ebf4b0e894

SHA512
ca4efcb64d48b7020d7506804172e975da4df13f30e6d76b6fa287ebcedea804a6e9dd938837c12f1ec11077eb539677790ee95d0101f9792be36573d7fa48ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
d1e2eca4bb28c7ba842c451f7abfdb40

SHA1
bbbf9b5366e46431eed40e4cc22d91b2abd8cc1f

SHA256
3b44d4a4f822910d330f68b0d9e8940b403f43b2529971a0d5ded7d2eccaee39

SHA512
5d990ed1c7df64f6ede443d8c8b6cf6c4a2cf16cf4529672b3b9263912fd422a5b90083b6fbd05c55a350210678b707780b22cdac5212bc50f2e950ac2ae1d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
6f1fad89a324d2f1e25f9be1c6873a24

SHA1
47bd1533383540b095ef2082039b6da1a546f225

SHA256
a03359d9e1255e4e6086773284da94f415cd814a71d56535efa5b0546f920c04

SHA512
bd02e68b08237564474b7d95e18f80bd0593579527a93fe8f5e35c8874a950766745bb74d51560a3a331a1dfcb5d18abc32b8a9db211de3301fcd5d1c7cb4ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
70310c5893a37ea8047ea31ca8eff30d

SHA1
9fee895d68921650a0f278c6e345f98e45d871fe

SHA256
2f3fd67519534cf4e397c9904b7248c58c45f52d0ade576691ebf3d0f9c156d1

SHA512
1a3b41ab01c2f9e706f15a8b3127b942aa8e033405a43bec99ae028edbee35efd9249f65b21c0dd5fff7a9c6a7a7051a8d611037ec6fed14949fb859248b2c3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
a423f0b71709149026ab970d81c21685

SHA1
74a1818d6ddb9a144334c4a6b1f5c9f81c0c4a69

SHA256
65e5e492ad7765b1b4de9e59259c9f3bbfe69e41a3f091e7328f8ee6e2994e48

SHA512
7ee0085f51b8a08a104d096c0890c974147aa2dd04ff3ad9deb7c0fe20b22e4b58259161ecb649e809193555c1f1b6154bfb6cddd8887b7992a8fd6e4852f6ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
c2013780066fdb1971d17c80cdaaa4ea

SHA1
9d4ae93f5cdddb48fbb7820514a193addbebfac7

SHA256
7e37da8314a29964ce6e87ea52f363a98cc052628633d76326ee878e8f8ff681

SHA512
e41501c8465d67369a95c97a0e82b53d9f93a599427834ed7f906df9366a76a35620cd130917d7a07a81fa480dbfaa82b1f3e5ada00fe821a3125e53a79bca0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
48baf7db2097cbd3773312ca3bd58f21

SHA1
6f97cb014a30bebefb31e90298b39e9d403080b5

SHA256
a47ccdfa678d5b761d3dc57f99d8fe13e5fe9bf6f7f4aa9ed8339a766bbfdce5

SHA512
af01cc309220a8639f4730db75b52a7d3d0a26af4ec0f18d6d5d548c0b2789adf8dfe601e5c4432df4e9e525a69df9aadf22a3ca271bdaef1d8266cea653c73e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
46fac2ae3065028cf02640ac02dfc99e

SHA1
03e7eda4f521d50439115898abecaf6c1ce99542

SHA256
73d6a525e2770d7cbf09185aaa430af08987e330a549df0399e4e5960fe8286d

SHA512
1d9c4a0ff1ec2c2943b8cd37aeb80082da4f0ef071e67222914cf91a159d9209a402ca6d86f7251ffd323a98774a35f8f515508830ada18f283156575181a719

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
5268b366c02b7ec8963934f24802e810

SHA1
14bb690e6aaa27d8c5db850fa13e9c6bce76049c

SHA256
4003abee196311ec1dfa553115fbd0ff9dcedc305c7833bb5e39b91d4fd3d8ea

SHA512
987c2adf7452fac8777849fa5038743f0bc89a8a457ee1698aaaf4a89fa9f6822d5b2e42465ef61a48726656b4bc433453e6106047c4535db4f49e970e79f80e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f19b7fa41504143c72ad7230bf3099de

SHA1
207f22957441e46796020aeec865c97feb651003

SHA256
56f45ebd71e9c42b13bd48e1f428eb1c370289192a1573f03ccc76b00c05f337

SHA512
4aad4b0e178cac1a120cc10d8a10a91e2c43190b2571433ddfd858d10baf4599256f3ab45daa73516d14a1489417331e8a52ce9c5d2f7fe50d400360755df41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
6b8df77fc59937c3290fa67a223cc630

SHA1
4eccd0180866472080880f9fe3ed555be435126f

SHA256
e995a63f802d65c2f534bf811fe28f0b46faa9b4917cd8d6e00f2afd6d021029

SHA512
01cd9fb87986e5c785b39b6516979adc19cb4b9ac2f78f53324617781455e64f018a7e9bdce8ec2c1150310e4629ca0ee81f163a4df766bbecf321875e7fe741

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
0d5292d7f472ebfe8eb815629b433f51

SHA1
e08a3f0799cc67030dd53f0c7d05b4655d9dd1e7

SHA256
2452809472c089202f68178ed3e839ac6667ee5b7b7f079781641ad74cdd8d42

SHA512
9069a2772b100dd36b9eb4b4e7f19fa0f1ae84dc29e4c1d1a0d1d758dd2b77c8246c862ce16e8bdf266a4d4483469992582594635728a5148a25b164ce2bc2e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
90fae033208daccb1efde230fac55ee0

SHA1
7ee5cef5fb0a54e33b792729b3c028d854676f70

SHA256
dd096b741f7c2a35cc3a53b77c85eca1d93fcd17c696fffe48ff397eb7d588da

SHA512
1a915913ed852d0eb7d4cb9f93b81ab27f79fa22b6a42d4d1f7a0322b2b647bca00d7878a1dcda30b3aa9c7cbd9839514829f9812add3bf12960c5211bc2178e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
e88a711ab5a48de52306ca72d8aa2a7a

SHA1
5cfee942a3bf83f1109d4f71dde3851dd0d84b1f

SHA256
65d41d7bb13878414d4fe406b5fc55e8890d3172f82178b4a1b4d50146ef6c23

SHA512
bb36c3bc2a0d9bc24c806a66bc4fb59ac341e2b19a320b4919b7b996bf696366372ecac3bf90b963256746e5cba77c98e09b4222506bd80490b1ab55951dd71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
d554555e7622ccc4b1847a7e424ac1e7

SHA1
ca0c042d7b809acac51a1f2b91d56f199cdcd8e3

SHA256
89946946a4f811a52b4c06928c852cd7c089caec1566a008777df17e0d46b493

SHA512
abca6e61a48876534ff34e42b4d04f3ed8949cf6da1950f93b224f61b0dc84daf258b1783bb774f3ff5bc22a33b5ae4306eff49f272dd052c5758aa5cdfc615f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
9456c16f7067b3f8c2b3184dba41afa8

SHA1
6ceb12e6cc6fdeb93491768c7e32a516e362b340

SHA256
24131eeb8affb3ce7c318cac0004bf8cec8ea67b7d5070694202a069b665b185

SHA512
90fb47f7847f3d365fccd5280ba42c6474342d7702aebd4d31464d9fbf50b71461a10fe9c7c267e3a17a7612dfde3164eaeef88f2409616afed507264ed27735

Download Submit
\??\c:\directory\CyberGate\dvnet\dvnet\svchosts.exe

Filesize
764KB

MD5
317ba4f10b9c3889cc66e340695d4045

SHA1
c1db48a944810a8768711986925cb9732a350635

SHA256
28cefe1482e044e72fb9c47eef92e485fb4636a87d1445e310422fc132c0e239

SHA512
4a12dfe4ab277356e404f39d665888167ca367d3832373d224b0e89920fbbc0dd2a32ed79529dea97de8c546c5ff46473f59eb8d54b3b04f948f54a8d6c2db63

Download Submit
memory/376-231-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/376-87-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/376-99-0x0000000010480000-0x00000000104E1000-memory.dmp

Filesize
388KB

Download
memory/376-96-0x0000000010410000-0x0000000010471000-memory.dmp

Filesize
388KB

Download
memory/376-95-0x0000000010410000-0x0000000010471000-memory.dmp

Filesize
388KB

Download
memory/376-92-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/376-88-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2564-100-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/2564-101-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/2880-253-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4312-76-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-66-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-56-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-55-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-45-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-43-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-42-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-41-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-86-0x0000000000400000-0x00000000005AA000-memory.dmp

Filesize
1.7MB

Download
memory/4312-40-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-39-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/4312-38-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-37-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4312-36-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/4312-35-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/4312-34-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4312-33-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-32-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/4312-31-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4312-30-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4312-29-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4312-28-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4312-27-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4312-25-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-24-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-23-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-22-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-19-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-18-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-17-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-16-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-15-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-14-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-13-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-12-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-11-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-10-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4312-60-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-61-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-62-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-91-0x0000000000400000-0x00000000005AA000-memory.dmp

Filesize
1.7MB

Download
memory/4312-90-0x0000000002350000-0x00000000023B0000-memory.dmp

Filesize
384KB

Download
memory/4312-63-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-64-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-65-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-59-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-67-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-70-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-71-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-72-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-1-0x0000000002350000-0x00000000023B0000-memory.dmp

Filesize
384KB

Download
memory/4312-73-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-9-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-74-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-75-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-0-0x0000000000400000-0x00000000005AA000-memory.dmp

Filesize
1.7MB

Download
memory/4312-78-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-79-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-80-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-81-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-82-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-83-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-84-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-85-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-77-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-69-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-68-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-58-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-57-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-46-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4312-47-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-48-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-49-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-50-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-51-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-52-0x0000000003470000-0x0000000003570000-memory.dmp

Filesize
1024KB

Download
memory/4312-44-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-26-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-20-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/4312-21-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/4312-2-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4312-3-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4312-4-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/4312-5-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4312-6-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4312-7-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/4312-8-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4412-250-0x0000000000400000-0x00000000005AA000-memory.dmp

Filesize
1.7MB

Download
memory/5092-254-0x0000000000400000-0x00000000005AA000-memory.dmp

Filesize
1.7MB

Download