cybergate | f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9

Analysis

max time kernel
153s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Size

290KB
MD5

06b42f52cf12af8331db71f844a720f0
SHA1

4c5606aacafecd0ce2493a8eca14c941bb653ae9
SHA256

f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9
SHA512

a717dccdf211e84f11d632f0f5e50780099e06825142b7ce0f5d516ebc370b7f647ae72368b7528aaded1db501bb97531ecaec6c8f98caaf59a4ae5923258fc4
SSDEEP

6144:ImcD66RRjw5JGmrpQsK3RD2u270jupCJsCxCa:BcD663NZ2zkPaCxV

Score

10^/10

cybergate n0de persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

N0de

127.0.0.1:81

nadoosh.zapto.org:81

Mutex

NOPB06FM77BQN7

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
N0de
install_file
N0de
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\N0de\\N0de"	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\N0de\\N0de"	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OQN4RXL7-GQ3U-S4GE-8400-78AJMHB32M7E}\StubPath = "C:\\Windows\\system32\\N0de\\N0de Restart"	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OQN4RXL7-GQ3U-S4GE-8400-78AJMHB32M7E}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{OQN4RXL7-GQ3U-S4GE-8400-78AJMHB32M7E}\StubPath = "C:\\Windows\\system32\\N0de\\N0de"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{OQN4RXL7-GQ3U-S4GE-8400-78AJMHB32M7E}	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2016-56-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/2016-65-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/952-70-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/952-73-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/2016-75-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/2016-81-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/968-86-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/968-87-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/968-88-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\N0de\\N0de"	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\N0de\\N0de"	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\N0de\N0de	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
File opened for modification	C:\Windows\SysWOW64\N0de\N0de	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
File opened for modification	C:\Windows\SysWOW64\N0de\N0de	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
File opened for modification	C:\Windows\SysWOW64\N0de\	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
968	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
Token: SeDebugPrivilege	968	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14
PID 2016 wrote to memory of 1380	2016	f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
  "C:\Users\Admin\AppData\Local\Temp\f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:952
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe
    "C:\Users\Admin\AppData\Local\Temp\f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
a5107449a783134707ebb992c1b10564

SHA1
bced51c6d717d7c67353522aafb00c8dd32281fc

SHA256
91c6d987b085a8dbab5fbfbec933d85af47df30d3eb224a2c3a459276b865c8e

SHA512
42ea5f5ec36943d67a15e61702930fbd3c83925296fa428537302c81369a8fa0d6e54e45afa72e164eeab431649d901277c9fbcd74477e7e9651cf8c6c9b5bf5

Download Submit
C:\Windows\SysWOW64\N0de\N0de

Filesize
290KB

MD5
06b42f52cf12af8331db71f844a720f0

SHA1
4c5606aacafecd0ce2493a8eca14c941bb653ae9

SHA256
f65201f7c8dfac877d8e37d33d1f8071fd723ffc9ece0d9bdbe768191a80b8e9

SHA512
a717dccdf211e84f11d632f0f5e50780099e06825142b7ce0f5d516ebc370b7f647ae72368b7528aaded1db501bb97531ecaec6c8f98caaf59a4ae5923258fc4

Download Submit
memory/952-64-0x0000000074D31000-0x0000000074D33000-memory.dmp

Filesize
8KB

Download
memory/952-73-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/952-62-0x0000000000000000-mapping.dmp

Download
memory/952-70-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/968-79-0x0000000000000000-mapping.dmp

Download
memory/968-86-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/968-87-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/968-88-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1380-59-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2016-65-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2016-56-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2016-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/2016-75-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/2016-81-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download