agenttesla | 00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
Size 433KB
Sample240613-bcvvfayapg
SHA256 00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6
MD5 8679a39e2b0abec131fba635ac5395a4
SHA1 95af87b3b3bbb7769a18f8cad0400068803090b5
SHA512 805a333022aab5837d0ff7765d6beab5d606c3b0f36d3c81d110923f745a2db8f10cff222c8c08fb20b46c8826cbd7936bfae1e18c70cc7ac5ee25dd876c2c9a
SSDEEP 3072:CPB6kNIVvqUBkohcXy5UBteVT4w0WSe5eAHM9gSMhqS+SRUQCIDvGUQyHjD:CPckNI0MhcXVteVT4B5h9gSMXU4xHD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla xworm keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
webmail.mado.com.tr
Port
587
Username
[email protected]
Password
**Mado1245??

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
webmail.mado.com.tr
Port
587
Username
[email protected]
Password
**Mado1245??
Email to
[email protected]

Extracted

Family

xworm

Version

178.215.236.251:717

Mutex

0AVeWj1eTvHM3Un2

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1760-9817-0x0000000000400000-0x0000000000412000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

resource	yara_rule
behavioral2/memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/1760-9817-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing URLs to raw contents of a Github gist 3 IoCs

resource	yara_rule
behavioral2/memory/1352-1-0x0000000000990000-0x0000000000A02000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x0008000000023415-4902.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4092-4910-0x00000000004F0000-0x0000000000564000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/memory/1760-9817-0x0000000000400000-0x0000000000412000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	doc_10_50.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	doc_10_50.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	doc_10_50.exe

Executes dropped EXE 2 IoCs

pid	Process
4092	doc_10_50.exe
1760	doc_10_50.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Folce = "C:\\Users\\Admin\\AppData\\Roaming\\Folce.exe"	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Folce = "C:\\Users\\Admin\\AppData\\Roaming\\Folce.exe"	doc_10_50.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 4092 set thread context of 1760	4092	doc_10_50.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1784	ipconfig.exe
3644	ipconfig.exe
4356	ipconfig.exe
4396	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1700	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
1700	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
1760	doc_10_50.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
Token: SeDebugPrivilege	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
Token: SeDebugPrivilege	4092	doc_10_50.exe
Token: SeDebugPrivilege	1700	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
Token: SeDebugPrivilege	4092	doc_10_50.exe
Token: SeDebugPrivilege	1760	doc_10_50.exe
Token: SeDebugPrivilege	1760	doc_10_50.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
1760	doc_10_50.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 412	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	87
PID 1352 wrote to memory of 412	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	87
PID 1352 wrote to memory of 412	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	87
PID 412 wrote to memory of 1784	412	cmd.exe	89
PID 412 wrote to memory of 1784	412	cmd.exe	89
PID 412 wrote to memory of 1784	412	cmd.exe	89
PID 1352 wrote to memory of 4092	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	91
PID 1352 wrote to memory of 4092	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	91
PID 1352 wrote to memory of 4092	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	91
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1700	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	92
PID 1352 wrote to memory of 1328	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	93
PID 1352 wrote to memory of 1328	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	93
PID 1352 wrote to memory of 1328	1352	00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe	93
PID 1328 wrote to memory of 3644	1328	cmd.exe	95
PID 1328 wrote to memory of 3644	1328	cmd.exe	95
PID 1328 wrote to memory of 3644	1328	cmd.exe	95
PID 4092 wrote to memory of 4320	4092	doc_10_50.exe	96
PID 4092 wrote to memory of 4320	4092	doc_10_50.exe	96
PID 4092 wrote to memory of 4320	4092	doc_10_50.exe	96
PID 4320 wrote to memory of 4356	4320	cmd.exe	98
PID 4320 wrote to memory of 4356	4320	cmd.exe	98
PID 4320 wrote to memory of 4356	4320	cmd.exe	98
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 1760	4092	doc_10_50.exe	99
PID 4092 wrote to memory of 2328	4092	doc_10_50.exe	100
PID 4092 wrote to memory of 2328	4092	doc_10_50.exe	100
PID 4092 wrote to memory of 2328	4092	doc_10_50.exe	100
PID 2328 wrote to memory of 4396	2328	cmd.exe	102
PID 2328 wrote to memory of 4396	2328	cmd.exe	102
PID 2328 wrote to memory of 4396	2328	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
"C:\Users\Admin\AppData\Local\Temp\00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /release
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1784
- C:\Users\Admin\AppData\Local\Temp\doc_10_50.exe
  "C:\Users\Admin\AppData\Local\Temp\doc_10_50.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:4356
- - C:\Users\Admin\AppData\Local\Temp\doc_10_50.exe
    "C:\Users\Admin\AppData\Local\Temp\doc_10_50.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /renew
      4⤵
      Gathers network information
      PID:4396
- C:\Users\Admin\AppData\Local\Temp\00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe
  "C:\Users\Admin\AppData\Local\Temp\00f9985ce5ead924571059504e5e0f699dc55013da6969752da86eaae8c396a6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /renew
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

doc_10_50.exe

Path C:\Users\Admin\AppData\Local\Temp\doc_10_50.exe
Size 435KB
SHA256 94691a039d6ae6fe2227051116e13d8875f496df3e77eb129e6a56c97806be1f
MD5 f7d55edf4c77e30e86619d6ff68bc2a9
SHA1 35ed927cf35bd85c81635f3f2aafe2f5ef416001
SHA512 992b2627eb92474297a3f080b2905e16240722e58686643771446223d257cd389cb386653158cbc0b742d23ca84b6163bc672210cf26d0f287b52bc875edcb84
SSDEEP 6144:dyAhYqUsd0oGXGbgrmJtdLGEmtY/fPAZU4gHD:d588grgtVzJJHD
MD5 SHA1 SHA512 SSDEEP

Submit Download

folce.exe

Path \??\c:\users\admin\appdata\roaming\folce.exe
Size 128KB
SHA256 bdecd5370e54b5866ca748d8205bc07c5e6aa4ee7fefc32f363d8b7712eae9b9
MD5 9f27d09315f83ca10849d870f6f9bb47
SHA1 2f264baad5d0e8d43f384eada3378016232d7695
SHA512 7fcc897e2d5d41e358ed40c329de6bcc2ed6d7ddaefbb80be2dde6ac6176d28b26a58ce7a94df4f55cfd3813e46307fc0a5e5d3b8853e528df5b8f1584864332
SSDEEP 1536:69fKqSEVlB6SAu7875zNS1y4xXA7oFiVEOHfqOiEV1emv4:CPB6kNIVvqUBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1352-11-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-25-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-3-0x0000000007740000-0x0000000007990000-memory.dmp

Download

memory/1352-4-0x0000000007F40000-0x00000000084E4000-memory.dmp

Download

memory/1352-5-0x0000000007A40000-0x0000000007AD2000-memory.dmp

Download

memory/1352-15-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-17-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-51-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-65-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-67-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-63-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-61-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-59-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-57-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-55-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-31-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-49-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-47-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-45-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-44-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-39-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-37-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-41-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-35-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-33-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-27-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-23-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-21-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-19-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-13-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-2-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/1352-1-0x0000000000990000-0x0000000000A02000-memory.dmp

Download

memory/1352-54-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-29-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-9-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-7-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-6-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-69-0x0000000007740000-0x000000000798B000-memory.dmp

Download

memory/1352-4587-0x0000000074FDE000-0x0000000074FDF000-memory.dmp

Download

memory/1352-4894-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/1352-4893-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/1352-4896-0x0000000006150000-0x000000000619C000-memory.dmp

Download

memory/1352-4895-0x0000000005DC0000-0x0000000005E4C000-memory.dmp

Download

memory/1352-4897-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/1352-4909-0x00000000061A0000-0x00000000061F4000-memory.dmp

Download

memory/1352-4918-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/1352-0-0x0000000074FDE000-0x0000000074FDF000-memory.dmp

Download

memory/1700-4914-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1700-4916-0x0000000005450000-0x00000000054B6000-memory.dmp

Download

memory/1700-4919-0x0000000006950000-0x00000000069A0000-memory.dmp

Download

memory/1700-4920-0x0000000006A40000-0x0000000006ADC000-memory.dmp

Download

memory/1700-4921-0x0000000006B10000-0x0000000006B1A000-memory.dmp

Download

memory/1700-9812-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/1700-4917-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/1760-9817-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4092-4912-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/4092-4915-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/4092-9809-0x0000000005800000-0x000000000585C000-memory.dmp

Download

memory/4092-9810-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/4092-4922-0x0000000007160000-0x0000000007382000-memory.dmp

Download

memory/4092-4910-0x00000000004F0000-0x0000000000564000-memory.dmp

Download

memory/4092-9811-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/4092-9823-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download