agenttesla | 0b6b634a3d763601e989506f485f0bbbb9aa0b739f34d5566069bfd7bdc05904

Analysis

max time kernel
32s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Balancepayment.exe
Size

392KB
MD5

9380d44800fbdf3899fe1d04af533d1f
SHA1

a052510980763e83d19c3f9824ea58a5f4eab2b3
SHA256

0b6b634a3d763601e989506f485f0bbbb9aa0b739f34d5566069bfd7bdc05904
SHA512

8e2e205984f1672df25d4c78fca631290706e793677f480b0d088e60bdbef6b91b5e7752175cef0d85fc6c381adf39c64cb3ba6c4578ddbd5b7a79dff9f7be99
SSDEEP

6144:WSodkdIGvvJXFj+3vsW5qeP0sCuTiw14LqcCiNMF2eR2BQ1hZnhG5rO/lGFNzTbn:WSFdIGZVjukc044NCiSx71HsKGXJSA

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
Kene123456789
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Balancepayment.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\International\Geo\Nation	Balancepayment.exe

Drops startup file 1 IoCs

Processes:

Balancepayment.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs Balancepayment.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

4492 ipconfig.exe
2300 ipconfig.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Balancepayment.exepowershell.exe

pid process

2556 Balancepayment.exe
1400 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Balancepayment.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2556 Balancepayment.exe
Token: SeDebugPrivilege 1400 powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs	Balancepayment.exe

pid	process
4492	ipconfig.exe
2300	ipconfig.exe

pid	process
2556	Balancepayment.exe
1400	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2556	Balancepayment.exe
Token: SeDebugPrivilege	1400	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Balancepayment.execmd.execmd.exe

description	pid	process	target process
PID 2556 wrote to memory of 3532	2556	Balancepayment.exe	cmd.exe
PID 2556 wrote to memory of 3532	2556	Balancepayment.exe	cmd.exe
PID 2556 wrote to memory of 3532	2556	Balancepayment.exe	cmd.exe
PID 3532 wrote to memory of 2300	3532	cmd.exe	ipconfig.exe
PID 3532 wrote to memory of 2300	3532	cmd.exe	ipconfig.exe
PID 3532 wrote to memory of 2300	3532	cmd.exe	ipconfig.exe
PID 2556 wrote to memory of 1400	2556	Balancepayment.exe	powershell.exe
PID 2556 wrote to memory of 1400	2556	Balancepayment.exe	powershell.exe
PID 2556 wrote to memory of 1400	2556	Balancepayment.exe	powershell.exe
PID 2556 wrote to memory of 4296	2556	Balancepayment.exe	cmd.exe
PID 2556 wrote to memory of 4296	2556	Balancepayment.exe	cmd.exe
PID 2556 wrote to memory of 4296	2556	Balancepayment.exe	cmd.exe
PID 4296 wrote to memory of 4492	4296	cmd.exe	ipconfig.exe
PID 4296 wrote to memory of 4492	4296	cmd.exe	ipconfig.exe
PID 4296 wrote to memory of 4492	4296	cmd.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\Balancepayment.exe
"C:\Users\Admin\AppData\Local\Temp\Balancepayment.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:2300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACcAaAB0AHQAcABzADoALwAvAGcAbwBvAGcAbABlAC4AYwBvAG0AJwA=
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
3⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
4⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
4⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
4⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
4⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
4⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
4⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
4⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
4⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
4⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
4⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
4⤵
PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
4⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:1
4⤵
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
4⤵
PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13213787588279676859,3793132787461426676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
4⤵
PID:4792

C:\Users\Admin\AppData\Local\Temp\Balancepayment.exe
C:\Users\Admin\AppData\Local\Temp\Balancepayment.exe
2⤵
PID:4848

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
1⤵
- Gathers network information
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe8d7546f8,0x7ffe8d754708,0x7ffe8d754718
1⤵
PID:4004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Balancepayment.exe.log

Filesize
1KB

MD5
8c2da65103d6b46d8cf610b118210cf0

SHA1
9db4638340bb74f2af3161cc2c9c0b8b32e6ab65

SHA256
0e48e2efd419951e0eb9a8d942493cfdf5540d1d19ff9dae6f145fb3ebcbeeac

SHA512
3cf5a125276e264cd8478f2b92d3848fb68b96d46eb4a39e650d09df02068c274881a1c314cdfbfdcb452672fb70dd8becf3ffe9562d39919d9c4d6b07fbb614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
330c53ed8d8829bd4caf2c392a894f6b

SHA1
dc4f3eea00d78949be4aded712fcbfe85e6b06a5

SHA256
bbca8b0343812fb9db9b3c59655a18772c7c40bc77f497b89067a82d5e4ce8a5

SHA512
37674d84e4ea2079e8fe9bc45b0ea8fd93ffc8d206547835e4211046ad310ba3e5a397cf444b17a4322f9513cbd91bd92c0b106776b879cb0388ca9386ebd44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4facfffc555b49f89520142559119dcd

SHA1
867f1ceb98ac7613e8b1c050cc91d75614300cca

SHA256
523e0f417c515e13c8f9cfa73c8d8bdd3c15b5247e5fafc289edc94c2d939630

SHA512
c58ad8b899ef3d9539f7e6411e27e5ebefb28fb80aec4484e88dffdbc62d4348845f74cedcd2cc08d47911abe9473e8c9bc82a317a7ba34a66461f10ff236fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0df5df681519f1c018813c28cad0b0e9

SHA1
ca418d661396e3712b650ddc2f67cfacb9a05615

SHA256
e84fbe2c710723b4a1ab3e284ca65f47431f777ec11c506c4c546a3a57fe9449

SHA512
94aa9f74b2f553777d99cb413bdfa7e88b6de150f0fa2e6fb7479b4e470caeca14a691e4e308b11feafadca319d5b880bd44881661909efddb6a6b8aec988381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
43bd7597206ab5574668e992a662bd79

SHA1
831828d87e1a6072ac9a2e1460a3c20968406b3e

SHA256
816f55b13c9afc5e0042184cba7aa3612e7819979a9a6721f79bd1811408e768

SHA512
bf91955069b44b2f47a38e101e06d86e83b0bd23892915cd058c6516609ea8ae714cc22d20a2e0e63f423b3b4dd50907ad2736134859f15a87160ff10248f4a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
b6612eca9d3ed748b3bff153cb269820

SHA1
2db5dd2295a32b435516d37c21cec2c924288cd3

SHA256
34eecf1be67fbc43d89ae2fb5cf8e66d0ff7649caa5c949581551b4016133f9e

SHA512
28bbce6176f61e8896e16b797685c800b8b530593b622f45bf640ed106f4aeb2d44bf2d67df3d05edc6d72306931946eb6256f50753db1fd6ab6c0f0f9423cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
84b8872ccd56ad4d14fdc560e5fbed1d

SHA1
2e924c090aabbd1d0944cab49b6f2e2b5fb65d62

SHA256
0f2b1fd6a4bbad29e9b7950c634dbb7444c12dd6824ad2a736e5d179eb97332f

SHA512
7f7de7e7d62e209985819c06436de53b2b2b13918571632db0c9c0f5380b7ebf4d491ec20f71b952b05d4a5e97481c3b9f6346e347dd043a63af1b9f1c43249f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
9af8fb67c6a664de58b9e9d40a473be3

SHA1
4bbfa4bc6010aa3c166be350044befec3b470477

SHA256
869603e1c7ecdc4ba1f93f46a5cc4d0e866fbbd6eadcff58232774f50ceb86e9

SHA512
3eae3671e7f60cee886851beb16ec13ce058d44cdad5cf64a42c66e477f4fb78b5258d7f2e18228daadf84ec59f996199c6c1d3c459c0bdabe61fd205a614fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a3gcldpg.ksw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_4656_UTYDBXRPKNUIFUPW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1400-14-0x00000000026E0000-0x0000000002716000-memory.dmp

Filesize
216KB

Download
memory/1400-32-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

Filesize
120KB

Download
memory/1400-40-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/1400-23-0x0000000004EF0000-0x0000000004F56000-memory.dmp

Filesize
408KB

Download
memory/1400-31-0x0000000005640000-0x0000000005994000-memory.dmp

Filesize
3.3MB

Download
memory/1400-22-0x0000000004E80000-0x0000000004EE6000-memory.dmp

Filesize
408KB

Download
memory/1400-33-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

Filesize
304KB

Download
memory/1400-19-0x0000000004DE0000-0x0000000004E02000-memory.dmp

Filesize
136KB

Download
memory/1400-18-0x0000000005010000-0x0000000005638000-memory.dmp

Filesize
6.2MB

Download
memory/1400-17-0x00000000026D0000-0x00000000026E0000-memory.dmp

Filesize
64KB

Download
memory/1400-16-0x00000000026D0000-0x00000000026E0000-memory.dmp

Filesize
64KB

Download
memory/1400-15-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/1400-36-0x0000000006220000-0x0000000006242000-memory.dmp

Filesize
136KB

Download
memory/1400-35-0x00000000061A0000-0x00000000061BA000-memory.dmp

Filesize
104KB

Download
memory/1400-34-0x0000000006C40000-0x0000000006CD6000-memory.dmp

Filesize
600KB

Download
memory/2556-11-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/2556-5-0x00000000054E0000-0x00000000054EA000-memory.dmp

Filesize
40KB

Download
memory/2556-10-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/2556-9-0x00000000059A0000-0x00000000059EC000-memory.dmp

Filesize
304KB

Download
memory/2556-76-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/2556-1-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/2556-2-0x0000000005B00000-0x00000000060A4000-memory.dmp

Filesize
5.6MB

Download
memory/2556-8-0x0000000005960000-0x00000000059A0000-memory.dmp

Filesize
256KB

Download
memory/2556-3-0x0000000005550000-0x00000000055E2000-memory.dmp

Filesize
584KB

Download
memory/2556-7-0x0000000005820000-0x0000000005860000-memory.dmp

Filesize
256KB

Download
memory/2556-4-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/2556-0-0x0000000000AA0000-0x0000000000B08000-memory.dmp

Filesize
416KB

Download
memory/2556-6-0x00000000057C0000-0x0000000005818000-memory.dmp

Filesize
352KB

Download
memory/4848-86-0x0000000006410000-0x0000000006460000-memory.dmp

Filesize
320KB

Download
memory/4848-87-0x0000000006500000-0x000000000659C000-memory.dmp

Filesize
624KB

Download
memory/4848-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4848-126-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4848-127-0x0000000005410000-0x0000000005420000-memory.dmp

Filesize
64KB

Download
memory/4848-77-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4848-78-0x0000000005410000-0x0000000005420000-memory.dmp

Filesize
64KB

Download