zgrat | 3b9330b09929cc5391a31e5780a967d26f21b010b586b2226e3d22038226f800

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe
Size

3.9MB
MD5

c93eb1803d22b1ea86a0e5b4c61ab5fc
SHA1

e1be31f724ba662e5067767f6144a3ce64167897
SHA256

3b9330b09929cc5391a31e5780a967d26f21b010b586b2226e3d22038226f800
SHA512

f2509c0e58064a517708e2cadee34805cf3d25043af41f70a34af69b6acfd74b09f1c0c2dc851128f2777e2e49bd9766c719c0f1f8bcf52d325bff54dcce08e1
SSDEEP

98304:yOYX6sYD1rXzznYLGRk3/ZuPqInTeNlZD6jdKkb8p:Fkdq1rIH3/OnaJuy

Score

10^/10

zgrat rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 4 IoCs

resource	yara_rule
behavioral2/files/0x000800000002321d-10.dat	family_zgrat_v1
behavioral2/memory/988-12-0x0000000000550000-0x00000000008E8000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0007000000023229-98.dat	family_zgrat_v1
behavioral2/files/0x000800000002322e-116.dat	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	3560	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	3560	schtasks.exe	96

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	agentreviewIntoRefdhcp.exe

Executes dropped EXE 2 IoCs

pid	Process
988	agentreviewIntoRefdhcp.exe
4532	sihost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Installer\fontdrvhost.exe	agentreviewIntoRefdhcp.exe
File opened for modification	C:\Windows\Installer\fontdrvhost.exe	agentreviewIntoRefdhcp.exe
File created	C:\Windows\Installer\5b884080fd4f94	agentreviewIntoRefdhcp.exe
File created	C:\Windows\ShellExperiences\sihost.exe	agentreviewIntoRefdhcp.exe
File created	C:\Windows\ShellExperiences\66fc9ff0ee96c2	agentreviewIntoRefdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4440	schtasks.exe
3852	schtasks.exe
3264	schtasks.exe
432	schtasks.exe
3408	schtasks.exe
3380	schtasks.exe
4900	schtasks.exe
3156	schtasks.exe
768	schtasks.exe
4484	schtasks.exe
4560	schtasks.exe
4044	schtasks.exe
1380	schtasks.exe
5052	schtasks.exe
4192	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	agentreviewIntoRefdhcp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe
988	agentreviewIntoRefdhcp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4532	sihost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	agentreviewIntoRefdhcp.exe
Token: SeDebugPrivilege	4532	sihost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1108	4884	3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe	90
PID 4884 wrote to memory of 1108	4884	3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe	90
PID 4884 wrote to memory of 1108	4884	3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe	90
PID 1108 wrote to memory of 4408	1108	WScript.exe	93
PID 1108 wrote to memory of 4408	1108	WScript.exe	93
PID 1108 wrote to memory of 4408	1108	WScript.exe	93
PID 4408 wrote to memory of 988	4408	cmd.exe	95
PID 4408 wrote to memory of 988	4408	cmd.exe	95
PID 988 wrote to memory of 4852	988	agentreviewIntoRefdhcp.exe	112
PID 988 wrote to memory of 4852	988	agentreviewIntoRefdhcp.exe	112
PID 4852 wrote to memory of 4712	4852	cmd.exe	114
PID 4852 wrote to memory of 4712	4852	cmd.exe	114
PID 4852 wrote to memory of 2936	4852	cmd.exe	115
PID 4852 wrote to memory of 2936	4852	cmd.exe	115
PID 4852 wrote to memory of 4532	4852	cmd.exe	117
PID 4852 wrote to memory of 4532	4852	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe
"C:\Users\Admin\AppData\Local\Temp\3b9330b09929cc5391a31e5780a967d26f21b010b586b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsWebSession\aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsWebSession\28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\MsWebSession\agentreviewIntoRefdhcp.exe
      "C:\MsWebSession/agentreviewIntoRefdhcp.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:988
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8k7WoMfspP.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4852
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4712
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2936
      - C:\Windows\ShellExperiences\sihost.exe
        
        "C:\Windows\ShellExperiences\sihost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Installer\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Installer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\MsWebSession\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\MsWebSession\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\MsWebSession\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellExperiences\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\MsWebSession\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MsWebSession\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\MsWebSession\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MsWebSession\28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat

Filesize
95B

MD5
d7fa26c8b1aa0d91d5c3682c87970269

SHA1
9934cb04ec5d81e86519c36c38d9e7caf5c01a1d

SHA256
102e9e1f76065e7c6207880bdcdba7cad4aebb61e2644ac80f76ed1a2ca92b1b

SHA512
71d72daaab45e8198d375a6fdf78bb7b3173c757cb2b6e349bbe516a67461b8ddb183ab028579f80c44392bba46a00b82f66bc5f01da4297af2a222be7ac5117

Download Submit
C:\MsWebSession\aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe

Filesize
250B

MD5
472b891861c2851f23fc56f0da9834f0

SHA1
1938881b09e054a23c46369d850f92c52a9b1164

SHA256
fee3cc05c5cd12982240bd1e83cf2362871ab9b656fd807928387ddb67e831f7

SHA512
77850c8c9d95733ff9128a9e19f87be4b64ee450ed4aa27be4dcaceded74c0ec8c05d57d8c78249c30ad8cdfcd96a9eeae51e587adef1ad38cd24a0125cbb129

Download Submit
C:\MsWebSession\agentreviewIntoRefdhcp.exe

Filesize
3.6MB

MD5
1e8b556d7c4cefe0023e5ba9b6d021e5

SHA1
1f2dd53b352fd7b5972b38d1a5eeb2aec378b9e5

SHA256
3ed028c17d0038c69998ad942feb78aff2f9f363bae2203250b0eba6ce0d26be

SHA512
788395a9013db192ff4054fc766aef4f55335c5816d0b5fa57d3019f7254aea32e194790930bc8255e05e80e9e9d5e2a77d0dfb45aac142c6f65edb9ae6061c0

Download Submit
C:\MsWebSession\backgroundTaskHost.exe

Filesize
320KB

MD5
32f9c6a2371b00201da5f10ec13d9716

SHA1
8f07dd41423c695ec7562b7374b460779ca5b791

SHA256
34bc05b3274a24a166853240ae0f6293fe3883fc9a64e7c54c29b1a1ea179ae4

SHA512
f4a46eb5317fb0970b53e6308e1b9cc5f0c2c3d653c434d1dbba83f38c324f981e95bfce46e806809c35d3373033f7841496a1b81347600a3277158521606f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8k7WoMfspP.bat

Filesize
214B

MD5
d9be5c6c98483d078352c7ae22175762

SHA1
68eded841f818603ef6f56b7f0ae07c1ad662622

SHA256
bcf86718d4695f869ab420c72a85331f32bd7ca58f6eec824c421243e8652b42

SHA512
ec949fe5bf6bd6b7fef50ee5bd925f90675c0abd347df0f04d8776422b2f0c225ab6af2905d09db1614044210f57e53fe1fadad8e3babaf2dab4fc2f696d6d49

Download Submit
C:\Windows\ShellExperiences\sihost.exe

Filesize
1024KB

MD5
5412c370c11788de3c87989f4f48cc89

SHA1
64bcbcf444ebd77cb6310c2e1016ac7214bd8b6a

SHA256
34d1c0bc4e159421d45f3b09cfb20d6745a203e0a2ccb5e82be8caa5d833e8e7

SHA512
2525c6c66b5564cbd577065d5a1e4c2443a3d552ff87e94c21f910a2b784424692a8445048df24bb9f179b840d0644720c86d7bd418304a6c7d166dcfc3680a7

Download Submit
memory/988-12-0x0000000000550000-0x00000000008E8000-memory.dmp

Filesize
3.6MB

Download
memory/988-13-0x00007FFAF1F40000-0x00007FFAF2A01000-memory.dmp

Filesize
10.8MB

Download
memory/988-14-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Filesize
64KB

Download
memory/988-15-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/988-16-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Filesize
64KB

Download
memory/988-19-0x00007FFB0FBC0000-0x00007FFB0FC7E000-memory.dmp

Filesize
760KB

Download
memory/988-18-0x0000000001290000-0x00000000012B6000-memory.dmp

Filesize
152KB

Download
memory/988-20-0x00007FFB0F470000-0x00007FFB0F471000-memory.dmp

Filesize
4KB

Download
memory/988-21-0x00007FFB0FBC0000-0x00007FFB0FC7E000-memory.dmp

Filesize
760KB

Download
memory/988-23-0x0000000000FF0000-0x0000000000FFE000-memory.dmp

Filesize
56KB

Download
memory/988-24-0x00007FFB0F460000-0x00007FFB0F461000-memory.dmp

Filesize
4KB

Download
memory/988-25-0x00007FFB0F450000-0x00007FFB0F451000-memory.dmp

Filesize
4KB

Download
memory/988-27-0x0000000002A70000-0x0000000002A8C000-memory.dmp

Filesize
112KB

Download
memory/988-28-0x0000000002AE0000-0x0000000002B30000-memory.dmp

Filesize
320KB

Download
memory/988-30-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/988-31-0x00007FFAF1F40000-0x00007FFAF2A01000-memory.dmp

Filesize
10.8MB

Download
memory/988-32-0x00007FFB0F440000-0x00007FFB0F441000-memory.dmp

Filesize
4KB

Download
memory/988-35-0x0000000002AB0000-0x0000000002AC8000-memory.dmp

Filesize
96KB

Download
memory/988-33-0x00007FFB0F430000-0x00007FFB0F431000-memory.dmp

Filesize
4KB

Download
memory/988-37-0x0000000001010000-0x0000000001020000-memory.dmp

Filesize
64KB

Download
memory/988-38-0x00007FFB0F420000-0x00007FFB0F421000-memory.dmp

Filesize
4KB

Download
memory/988-41-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/988-42-0x00007FFB0F410000-0x00007FFB0F411000-memory.dmp

Filesize
4KB

Download
memory/988-39-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Filesize
64KB

Download
memory/988-43-0x00007FFB0F400000-0x00007FFB0F401000-memory.dmp

Filesize
4KB

Download
memory/988-45-0x0000000002A90000-0x0000000002A9E000-memory.dmp

Filesize
56KB

Download
memory/988-46-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Filesize
64KB

Download
memory/988-49-0x000000001B650000-0x000000001B662000-memory.dmp

Filesize
72KB

Download
memory/988-47-0x00007FFB0F3F0000-0x00007FFB0F3F1000-memory.dmp

Filesize
4KB

Download
memory/988-52-0x00007FFB0FBC0000-0x00007FFB0FC7E000-memory.dmp

Filesize
760KB

Download
memory/988-53-0x00007FFB0F3E0000-0x00007FFB0F3E1000-memory.dmp

Filesize
4KB

Download
memory/988-51-0x0000000002AA0000-0x0000000002AAC000-memory.dmp

Filesize
48KB

Download
memory/988-55-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/988-56-0x00007FFB0FBC0000-0x00007FFB0FC7E000-memory.dmp

Filesize
760KB

Download
memory/988-57-0x00007FFB0F3D0000-0x00007FFB0F3D1000-memory.dmp

Filesize
4KB

Download
memory/988-58-0x00007FFB0F3C0000-0x00007FFB0F3C1000-memory.dmp

Filesize
4KB

Download
memory/988-60-0x000000001B670000-0x000000001B686000-memory.dmp

Filesize
88KB

Download
memory/988-63-0x000000001B690000-0x000000001B6A2000-memory.dmp

Filesize
72KB

Download
memory/988-61-0x00007FFB0F3B0000-0x00007FFB0F3B1000-memory.dmp

Filesize
4KB

Download
memory/988-64-0x000000001CEC0000-0x000000001D3E8000-memory.dmp

Filesize
5.2MB

Download
memory/988-65-0x00007FFB0F2F0000-0x00007FFB0F2F1000-memory.dmp

Filesize
4KB

Download
memory/988-67-0x0000000002B30000-0x0000000002B3E000-memory.dmp

Filesize
56KB

Download
memory/988-68-0x00007FFB0F0A0000-0x00007FFB0F0A1000-memory.dmp

Filesize
4KB

Download
memory/988-70-0x0000000002B40000-0x0000000002B50000-memory.dmp

Filesize
64KB

Download
memory/988-73-0x0000000002B50000-0x0000000002B60000-memory.dmp

Filesize
64KB

Download
memory/988-74-0x000000001B6D0000-0x000000001B6E0000-memory.dmp

Filesize
64KB

Download
memory/988-71-0x00007FFB0F090000-0x00007FFB0F091000-memory.dmp

Filesize
4KB

Download
memory/988-75-0x00007FFB0F080000-0x00007FFB0F081000-memory.dmp

Filesize
4KB

Download
memory/988-77-0x000000001C9F0000-0x000000001CA4A000-memory.dmp

Filesize
360KB

Download
memory/988-80-0x000000001B6B0000-0x000000001B6BE000-memory.dmp

Filesize
56KB

Download
memory/988-78-0x00007FFB0F070000-0x00007FFB0F071000-memory.dmp

Filesize
4KB

Download
memory/988-82-0x000000001B6C0000-0x000000001B6D0000-memory.dmp

Filesize
64KB

Download
memory/988-83-0x00007FFB0F060000-0x00007FFB0F061000-memory.dmp

Filesize
4KB

Download
memory/988-84-0x00007FFB0F050000-0x00007FFB0F051000-memory.dmp

Filesize
4KB

Download
memory/988-86-0x000000001C990000-0x000000001C99E000-memory.dmp

Filesize
56KB

Download
memory/988-88-0x000000001C9C0000-0x000000001C9D8000-memory.dmp

Filesize
96KB

Download
memory/988-89-0x00007FFB0F040000-0x00007FFB0F041000-memory.dmp

Filesize
4KB

Download
memory/988-91-0x000000001C9A0000-0x000000001C9AC000-memory.dmp

Filesize
48KB

Download
memory/988-92-0x00007FFB0F030000-0x00007FFB0F031000-memory.dmp

Filesize
4KB

Download
memory/988-95-0x000000001CCA0000-0x000000001CCEE000-memory.dmp

Filesize
312KB

Download
memory/988-94-0x00007FFB0F020000-0x00007FFB0F021000-memory.dmp

Filesize
4KB

Download
memory/988-111-0x000000001CDF0000-0x000000001CEBD000-memory.dmp

Filesize
820KB

Download
memory/988-113-0x00007FFB0FBC0000-0x00007FFB0FC7E000-memory.dmp

Filesize
760KB

Download
memory/988-114-0x00007FFAF1F40000-0x00007FFAF2A01000-memory.dmp

Filesize
10.8MB

Download
memory/4532-118-0x00007FFAF1F40000-0x00007FFAF2A01000-memory.dmp

Filesize
10.8MB

Download
memory/4532-175-0x000000001D370000-0x000000001D43D000-memory.dmp

Filesize
820KB

Download
memory/4532-176-0x000000001C800000-0x000000001C808000-memory.dmp

Filesize
32KB

Download