Malware Analysis Report

2024-11-30 04:13

Sample ID 240408-bdkqvsbh8y
Target b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e
SHA256 b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e
Tags
agenttesla keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e

Threat Level: Known bad

The file b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e was found to be: Known bad.

Malicious Activity Summary

agenttesla keylogger spyware stealer trojan

AgentTesla

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 01:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 01:01

Reported

2024-04-08 01:04

Platform

win7-20240215-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 2868 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 8.8.8.8:53 mail.iaa-airferight.com udp
NL 46.175.148.58:25 mail.iaa-airferight.com tcp

Files

memory/2868-0-0x00000000012C0000-0x0000000001354000-memory.dmp

memory/2868-1-0x0000000074590000-0x0000000074C7E000-memory.dmp

memory/2988-11-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2868-13-0x0000000074590000-0x0000000074C7E000-memory.dmp

memory/2988-16-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2988-14-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2988-7-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2988-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2988-6-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2988-5-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2988-4-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2868-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

memory/2868-2-0x0000000001140000-0x0000000001180000-memory.dmp

memory/2988-17-0x0000000074590000-0x0000000074C7E000-memory.dmp

memory/2988-18-0x0000000000220000-0x0000000000260000-memory.dmp

memory/2988-19-0x0000000074590000-0x0000000074C7E000-memory.dmp

memory/2988-20-0x0000000000220000-0x0000000000260000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 01:01

Reported

2024-04-08 01:04

Platform

win10v2004-20240226-en

Max time kernel

103s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe
PID 388 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe

"C:\Users\Admin\AppData\Local\Temp\b992bf551fd0035722e76414ee262298ecebafb7c6b8f777b70cc00e33b9551e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 mail.iaa-airferight.com udp
NL 46.175.148.58:25 mail.iaa-airferight.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
NL 46.175.148.58:25 mail.iaa-airferight.com tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
IE 52.111.236.23:443 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/388-0-0x0000000000670000-0x0000000000704000-memory.dmp

memory/388-1-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/388-2-0x0000000001030000-0x0000000001040000-memory.dmp

memory/4756-3-0x0000000000400000-0x0000000000442000-memory.dmp

memory/388-4-0x0000000002930000-0x0000000002931000-memory.dmp

memory/4756-7-0x0000000005510000-0x0000000005AB4000-memory.dmp

memory/4756-6-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/4756-14-0x0000000005110000-0x0000000005176000-memory.dmp

memory/4168-12-0x0000000005270000-0x0000000005280000-memory.dmp

memory/932-13-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/388-16-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/4168-15-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/4756-10-0x0000000004F50000-0x0000000004F60000-memory.dmp

memory/4168-9-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/4756-17-0x0000000006910000-0x0000000006960000-memory.dmp

memory/4756-18-0x0000000006A00000-0x0000000006A9C000-memory.dmp

memory/4756-19-0x0000000075000000-0x00000000757B0000-memory.dmp

memory/4756-20-0x0000000004F50000-0x0000000004F60000-memory.dmp

memory/4756-21-0x0000000006BC0000-0x0000000006C52000-memory.dmp

memory/4756-22-0x0000000006AD0000-0x0000000006ADA000-memory.dmp