zgrat | 8b5bc0141355c0b6ed6e40892c3e64500fe13e014cbe6d0623afbb6a2f934286

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdfb2d693550b116dcee622d470187e8.exe
Size 1.4MB
Sample231222-vvhsdaefa7
SHA256 8b5bc0141355c0b6ed6e40892c3e64500fe13e014cbe6d0623afbb6a2f934286
MD5 fdfb2d693550b116dcee622d470187e8
SHA1 31a0e9efe72e2fa387db4ee7e2ef52328e9e1766
SHA512 4b724041e202624664ea652bc2514614edc33815fa5de6e8c12731766f0085d51160ed27007e1c8ec36c7e41611b6edb5ec93a611bf8a8f4d35b4f41c6e2eae6
SSDEEP 24576:PT3E0UelkojTr7v9mWKJSgs0uLJrmSFHqPEkISEwCyJGPk7RR:rjUeKwvv9jo/s0UZNFHbwO0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat persistence rat vmprotect

Malware Config

Signatures

Detect ZGRat V1 4 IoCs

resource	yara_rule
behavioral2/memory/4848-0-0x0000000000880000-0x0000000000B44000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0006000000023210-12.dat	family_zgrat_v1
behavioral2/files/0x000600000002321f-46.dat	family_zgrat_v1
behavioral2/files/0x000600000002321f-45.dat	family_zgrat_v1

Process spawned unexpected child process 14 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	3552	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	3552	schtasks.exe	92

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	fdfb2d693550b116dcee622d470187e8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	fdfb2d693550b116dcee622d470187e8.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	sihclient.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4848-0-0x0000000000880000-0x0000000000B44000-memory.dmp	vmprotect
behavioral2/files/0x0006000000023210-12.dat	vmprotect
behavioral2/files/0x000600000002321f-46.dat	vmprotect
behavioral2/files/0x000600000002321f-45.dat	vmprotect

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\SmallRoom\\RuntimeBroker.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\AssignedAccessShellProxy\\RuntimeBroker.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\odt\\winlogon.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\perfi009\\RuntimeBroker.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\odt\\backgroundTaskHost.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\fontdrvhost.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\PerfLogs\\spoolsv.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\ModemLogs\\csrss.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\rilproxy\\taskhostw.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\StartUI\\StartMenuExperienceHost.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\notepad\\sysmon.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	fdfb2d693550b116dcee622d470187e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\winhlp32\\sysmon.exe\""	fdfb2d693550b116dcee622d470187e8.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\AssignedAccessShellProxy\RuntimeBroker.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\System32\rilproxy\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\System32\SmallRoom\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\System32\perfi009\RuntimeBroker.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\System32\perfi009\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\System32\rilproxy\taskhostw.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\System32\SmallRoom\RuntimeBroker.exe	fdfb2d693550b116dcee622d470187e8.exe
File opened for modification	C:\Windows\System32\SmallRoom\RuntimeBroker.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\System32\AssignedAccessShellProxy\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	fdfb2d693550b116dcee622d470187e8.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\fontdrvhost.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\5b884080fd4f94e2695da25c503f9e33b9605b83	fdfb2d693550b116dcee622d470187e8.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\ModemLogs\csrss.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\ModemLogs\886983d96e3d3e31032c679b2d4ea91b6c05afef	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\winhlp32\sysmon.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\winhlp32\121e5b5079f7c0e46d90f99b3864022518bbbda9	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI\StartMenuExperienceHost.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI\55b276f4edf653fe07efe8f1ecc32d3d195abd16	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\notepad\sysmon.exe	fdfb2d693550b116dcee622d470187e8.exe
File created	C:\Windows\notepad\121e5b5079f7c0e46d90f99b3864022518bbbda9	fdfb2d693550b116dcee622d470187e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3908	schtasks.exe
5044	schtasks.exe
4648	schtasks.exe
4900	schtasks.exe
2664	schtasks.exe
4320	schtasks.exe
3312	schtasks.exe
3520	schtasks.exe
4660	schtasks.exe
1828	schtasks.exe
208	schtasks.exe
3304	schtasks.exe
4216	schtasks.exe
3272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4848	fdfb2d693550b116dcee622d470187e8.exe
4848	fdfb2d693550b116dcee622d470187e8.exe
4848	fdfb2d693550b116dcee622d470187e8.exe
5028	fdfb2d693550b116dcee622d470187e8.exe
5028	fdfb2d693550b116dcee622d470187e8.exe
5028	fdfb2d693550b116dcee622d470187e8.exe
5028	fdfb2d693550b116dcee622d470187e8.exe
5028	fdfb2d693550b116dcee622d470187e8.exe
5028	fdfb2d693550b116dcee622d470187e8.exe
5028	fdfb2d693550b116dcee622d470187e8.exe
4904	sihclient.exe
4904	sihclient.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	fdfb2d693550b116dcee622d470187e8.exe
Token: SeDebugPrivilege	5028	fdfb2d693550b116dcee622d470187e8.exe
Token: SeDebugPrivilege	4904	sihclient.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 5028	4848	fdfb2d693550b116dcee622d470187e8.exe	95
PID 4848 wrote to memory of 5028	4848	fdfb2d693550b116dcee622d470187e8.exe	95
PID 5028 wrote to memory of 4904	5028	fdfb2d693550b116dcee622d470187e8.exe	116
PID 5028 wrote to memory of 4904	5028	fdfb2d693550b116dcee622d470187e8.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fdfb2d693550b116dcee622d470187e8.exe
"C:\Users\Admin\AppData\Local\Temp\fdfb2d693550b116dcee622d470187e8.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\fdfb2d693550b116dcee622d470187e8.exe
  "C:\Users\Admin\AppData\Local\Temp\fdfb2d693550b116dcee622d470187e8.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\ModemLogs\csrss.exe
    "C:\Windows\ModemLogs\csrss.exe"
    3⤵
    PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\perfi009\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\notepad\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\SmallRoom\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\rilproxy\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\AssignedAccessShellProxy\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\winhlp32\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ModemLogs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\PerfLogs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv lMR4Z8FyP0STSbS/ttNCTA.0.2
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fdfb2d693550b116dcee622d470187e8.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fdfb2d693550b116dcee622d470187e8.exe.log
Size 1KB
SHA256 f9c82a53d2671f346cceed279cd49e96372982e6a06029206f8a23f3d29ac237
MD5 b02b55a5615d27ec8a9873a1f02b17b6
SHA1 514b1de5480b69bbf4a8a5036fd6751f9ab8d9f5
SHA512 3e4ad8add7009ef0978d906111e4885e5ac216d9a1601dbbb218b0e73d4548aef3bcd1ea673029c649c10c702be16c9ba8857aa5cd8f28bf7b287d92baa1caa2
MD5 SHA1 SHA512

Submit Download

csrss.exe

Path C:\Windows\ModemLogs\csrss.exe
Size 92KB
SHA256 6a26e51311603dea70e113fb58627c0089a8bffdef1bfacb6ac2c0e167fff5d3
MD5 30b9d95f1a478b23b55c557f80fa29e9
SHA1 83f3366c86fb2054b131f5d3bded261788d596ce
SHA512 e4e6f3f9c2e8fe4dada91a5cb710603f87b1379031ee108e26c67b58a706d59b61a3c5bbb51a355964f57fcc321b5eb698eabdf54e5c7bf6383aade2bfc749d3
SSDEEP 1536:kn8BvbJ8ztX1BEMbWRU/0QRq7FzYzma27tumDsiwTKfIXch:FFenEUb/0jFzYz6EdfT/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe

Path C:\Windows\System32\perfi009\RuntimeBroker.exe
Size 384KB
SHA256 404148db98b623dc23ab50cef8e101643c8ff9a853144f9cef3238e306abd231
MD5 870d42b0a95dde7774ed7b6e86d19599
SHA1 f5871eded0edb763b37aff125ce12f8ff9cb49fa
SHA512 85974f52d91639a4e35d7d078875e149ba7f70a313f1ef44aebfec173f5bbc8d2d416236f64c264a53038974962170ac7ed9be48a99bad761e049923a6e220f4
SSDEEP 6144:vLUbcRzYe3t+EjcmG6joputUZdFidjuEDaBApk+Fn3vdWa1f/iJ3Gia5Z:PT3EMtUZdFidYxKsa5iFGDZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4848-20-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

Download

memory/4848-3-0x00000000012D0000-0x00000000012D1000-memory.dmp

Download

memory/4848-0-0x0000000000880000-0x0000000000B44000-memory.dmp

Download

memory/4848-2-0x000000001B960000-0x000000001B970000-memory.dmp

Download

memory/4848-1-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

Download

memory/4904-47-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

Download

memory/4904-50-0x000000001BD30000-0x000000001BD3C000-memory.dmp

Download

memory/4904-49-0x000000001BD10000-0x000000001BD18000-memory.dmp

Download

memory/4904-52-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

Download

memory/5028-21-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

Download

memory/5028-22-0x000000001B1F0000-0x000000001B200000-memory.dmp

Download

memory/5028-48-0x00007FFFAAD70000-0x00007FFFAB831000-memory.dmp

Download