cybergate | c37aafa6f6a5538b40ed18f4f3595f8e625e8929d354d60bb34f5f4605d7ad4d

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Size

289KB
MD5

11a7039a12fb0a0299980f67a8eeb049
SHA1

6edd70bf30eecfcfe2d4feb15ade61d51c333b98
SHA256

c37aafa6f6a5538b40ed18f4f3595f8e625e8929d354d60bb34f5f4605d7ad4d
SHA512

dfccfcc2d1c1559c760fe30a88394de30dee1bb5018d183afbf8ba54a6ec8c7bbce888aa5babd507ee616a9af5753ba245a40d097f15694d011f6c0bf8701551
SSDEEP

6144:1rCNOkuqMz2cbAuBWSLrhzXU35ns65JRzUWzHKONKqQJDfz:BAOrqMzvHBJrhbU3u+JRz9WOcqQ9z

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

vítima

127.0.0.1:81

cstrikemexico.servegame.com:81

Mutex

SoundBlaster

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
windir
install_file
win32.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
SoundBlaster
regkey_hklm
SoundBlaster

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windir\\win32.exe"	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windir\\win32.exe"	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\windir\\win32.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\windir\\win32.exe Restart"	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2696-8-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2696-12-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2696-6-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2696-15-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2696-16-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2696-18-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2696-17-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral1/memory/2696-732-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SoundBlaster = "C:\\Windows\\system32\\windir\\win32.exe"	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\SoundBlaster = "C:\\Windows\\system32\\windir\\win32.exe"	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

explorer.exe11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\windir\	explorer.exe
File created	C:\Windows\SysWOW64\windir\win32.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\windir\win32.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\windir\win32.exe	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

description pid process target process

PID 2852 set thread context of 2696 2852 11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe 11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

pid process

2696 11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1996 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 1996 explorer.exe
Token: SeDebugPrivilege 1996 explorer.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

pid process

2696 11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

pid process

2852 11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

description	pid	process	target process
PID 2852 set thread context of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

pid	process
2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

pid	process
1996	explorer.exe

description	pid	process
Token: SeDebugPrivilege	1996	explorer.exe
Token: SeDebugPrivilege	1996	explorer.exe

pid	process
2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

pid	process
2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe

description	pid	process	target process
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2852 wrote to memory of 2696	2852	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE
PID 2696 wrote to memory of 1216	2696	11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852

C:\Users\Admin\AppData\Local\Temp\11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\11a7039a12fb0a0299980f67a8eeb049_JaffaCakes118.exe
3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1688

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
189KB

MD5
4e24036e61f8c3ede76ab3d7087d2f57

SHA1
0dd93d9a8940a43514acc32dabc9682922b001d2

SHA256
96bfd2294c5178102b65ba4a8c61e58f1dbb9c48d0adef989d8edafdfe845b13

SHA512
c065e32c308f931c666dc2e09e3fac8f41b2c1d80cf5d9b70348650b97257619261814147d2cd7e248c94b1297f18a155b49261c92af36bd5f235a6706519d16

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat
Filesize
15B

MD5
4362e21af8686f5ebba224768d292a5b

SHA1
504510a4d10e230dcd1605ab3342525b38a10933

SHA256
b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3

SHA512
f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850

Download Submit
C:\Windows\SysWOW64\windir\win32.exe
Filesize
289KB

MD5
11a7039a12fb0a0299980f67a8eeb049

SHA1
6edd70bf30eecfcfe2d4feb15ade61d51c333b98

SHA256
c37aafa6f6a5538b40ed18f4f3595f8e625e8929d354d60bb34f5f4605d7ad4d

SHA512
dfccfcc2d1c1559c760fe30a88394de30dee1bb5018d183afbf8ba54a6ec8c7bbce888aa5babd507ee616a9af5753ba245a40d097f15694d011f6c0bf8701551

Download Submit
memory/1216-22-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1688-456-0x0000000000270000-0x00000000004F1000-memory.dmp

Filesize
2.5MB

Download
memory/2696-12-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2696-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-15-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-16-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-18-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-17-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-8-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2696-732-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2852-14-0x0000000000400000-0x000000000040E001-memory.dmp

Filesize
56KB

Download
memory/2852-0-0x0000000000400000-0x000000000040E001-memory.dmp

Filesize
56KB

Download
memory/2852-3-0x0000000000250000-0x000000000025F000-memory.dmp

Filesize
60KB

Download