agenttesla | cfa7488747bd2c7f8cd623cdebdd8154a2d2afc738b970b4a132e292b1c4e3c7

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER 61935400.js
Size 629KB
Sample261014-s3ygpagg59
SHA256 cfa7488747bd2c7f8cd623cdebdd8154a2d2afc738b970b4a132e292b1c4e3c7
MD5 702aa86ac7521bed1359e10a740a4584
SHA1 eb329b57fac484c5eed7224992172a28b0ad6274
SHA512 751df86cae5da42dadd6e2c3c15fe64d8f2d39c3cf598425eebf7ce424285681b1eb155670eff76a3b4c8ff5d7d3148bac6a5e471008e5b0780a0b2da92073d4
SSDEEP 12288:dknGBVhd5HWSyu0g2M+OQhyR0sDLlgAjFi8rAdMcvQUzYlOfYXocI6j/cX:SGBWg/2MXOhAjxr0McvdzYIuIX
TLSH
T1A9D4F0C24A05E491583CF34F4B3B6E3626F0165BA2CF98E8D17466BC6666303F1D9CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution agenttesla keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.gaiadeqi.com
Port
21
Username
[email protected]
Password
UHto%HHGCHK=,510

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	choice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\NlsCacheWarm_GMBJ = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\compat_store\\compat_store_CTIEPPIO.vbs\""	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4160	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3256 set thread context of 4500	3256	powershell.exe	110

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4904	powershell.exe
1244	powershell.exe
3480	powershell.exe
3256	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5100	cmd.exe
4320	cmd.exe
4224	cmd.exe
432	cmd.exe
2860	cmd.exe
4592	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4904	powershell.exe
4904	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
5728	choice.exe
5728	choice.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
3256	powershell.exe
3256	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	5728	choice.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	msiexec.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 4904	2488	wscript.exe	88
PID 2488 wrote to memory of 4160	2488	wscript.exe	90
PID 4160 wrote to memory of 2860	4160	cmd.exe	92
PID 2860 wrote to memory of 4900	2860	cmd.exe	93
PID 4160 wrote to memory of 1244	4160	cmd.exe	94
PID 4160 wrote to memory of 4592	4160	cmd.exe	95
PID 4592 wrote to memory of 4256	4592	cmd.exe	96
PID 4160 wrote to memory of 432	4160	cmd.exe	97
PID 432 wrote to memory of 4808	432	cmd.exe	98
PID 4160 wrote to memory of 5100	4160	cmd.exe	99
PID 5100 wrote to memory of 3212	5100	cmd.exe	100
PID 4160 wrote to memory of 4224	4160	cmd.exe	101
PID 4224 wrote to memory of 3380	4224	cmd.exe	102
PID 4160 wrote to memory of 4320	4160	cmd.exe	103
PID 4320 wrote to memory of 3368	4320	cmd.exe	104
PID 4160 wrote to memory of 3480	4160	cmd.exe	105
PID 3480 wrote to memory of 3256	3480	powershell.exe	106
PID 4160 wrote to memory of 5096	4160	cmd.exe	108
PID 3256 wrote to memory of 4500	3256	powershell.exe	110
PID 3256 wrote to memory of 5728	3256	powershell.exe	111
PID 4500 wrote to memory of 5728	4500	msiexec.exe	111
PID 4500 wrote to memory of 5728	4500	msiexec.exe	111

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5096	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	choice.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\NEW ORDER 61935400.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $RWMXG=$env:SXAMGPNI;$TFMLG=$env:EFKTUCRT+$env:QDPR+$env:OGZU+'.'+$env:NOXOXMVN;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($TFMLG));$OTOREJAY=0;$ZPOMU=foreach($HEGKPVP in [IO.File]::ReadAllLines($RWMXG)){if($HEGKPVP-eq'/*'){$OTOREJAY=1;continue};if($OTOREJAY-and$HEGKPVP-eq'*/'){break};if($OTOREJAY){$HEGKPVP}};[IO.File]::WriteAllLines($TFMLG,[string[]]@($ZPOMU),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"&rem BIRYCTAQXLNXW" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\system32\findstr.exe
      findstr /c:"&rem BIRYCTAQXLNXW" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
      4⤵
      PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:FSDNKNQ));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:QITYUCDZZQYA))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"&rem UYGCJSU" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\findstr.exe
      findstr /c:"&rem UYGCJSU" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
      4⤵
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"&rem MVYIOLT" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\findstr.exe
      findstr /c:"&rem MVYIOLT" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
      4⤵
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"&rem NDHLLAKPGVJAS" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\system32\findstr.exe
      findstr /c:"&rem NDHLLAKPGVJAS" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
      4⤵
      PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"&rem ZBDDVFWT" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\system32\findstr.exe
      findstr /c:"&rem ZBDDVFWT" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
      4⤵
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /c:"&rem YXVPIDYPMOYQJ" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\system32\findstr.exe
      findstr /c:"&rem YXVPIDYPMOYQJ" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
      4⤵
      PID:3368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:FSDNKNQ));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:QITYUCDZZQYA))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:FSDNKNQ));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:QITYUCDZZQYA))"
      4⤵
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4500
    - - C:\Windows\SysWOW64\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        
        PID:5728
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd"
    3⤵
    - Views/modifies file attributes
    PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

163290441552793.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\163290441552793.cmd
Size 611KB
SHA256 7239876fadc5aee8a2cfb87669bc752b16f2590938344b06cc2acbad20469de6
MD5 bf61d66f2b919f6bba7e302dfa421613
SHA1 e6e4f9d8523e37c1193e9c6e217e97e514d3ae3c
SHA512 9ea157b1e943f0f550a4856e1e1ddf3f913d4d544b3a66327ea9b2dadeafd76f468287167ad3cfb44d491f89c8abc56954e37a82ef62c3d55779067dcf32964d
SSDEEP 12288:TknGBVhd5HWSyu0g2M+OQhyR0sDLlgAjFi8rAdMcvQUzYlOfYXocI6j/v:YGBWg/2MXOhAjxr0McvdzYIuD
TLSH
T1C2D412508F01B8D1AC19D78E823D7F242AB05AADE7C5E8DC107872F5B7B7213D52E899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 4710aa1eb959174dba8cf01e1d483687c3c522e5777d0d8309f9c2e95e547830
MD5 f24fa9140eef06ce9d8c27db470fbc21
SHA1 a0ae8301a81ba48395cb8e6cc5606d0a8896b716
SHA512 916467969657cd6d4ee1759602de3073b7d8f9972bfde5223b79342d9980587ad49849af7b7aeda244141d54e519b8f3026a49f5189bdae07af0ac2abc351a6f
TLSH
T1F2116633F3CC8624DC5A413650CEAC1136B687CB409ECE6B7B84D154B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a88b4d0ec84631e55abc50e4f454e027158e171a7397cba2bf71f9c0c268ef11
MD5 16c0e24e6357cfc0e6eba4de15e6953e
SHA1 69cb3c1d34909243ae17692fa52b88b8fda75e58
SHA512 1cf694f77279f7c49a4a134759507a746e9ca6a93df9fbc3f198d8f7d46af9d9babd2db268b64961f179aee89871db5583153703c39f85b9501d4e63a6d178fd
TLSH
T175218933F3DC8654CC8A413A50CEAC0032B787DB809FCEEBBB84D544A42F689CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_41fkmh2k.jiz.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41fkmh2k.jiz.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_3256_e5acc3a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_3256_e5acc3a.txt
Size 96B
SHA256 70c4ffc84baedd44266ddb25bbb15aea75a0dd156bb3bf2e23183cbc46b1d7eb
MD5 0b4d0adf020cace2d48392c70bd2ab2d
SHA1 8146e31fa3b9db3c321036ae2c7e3d75c81e4bf7
SHA512 1de6b88b16399e64ef345570f5de1e4a9ce5bf4e2ad095435dffb0a1032c43e081fecaea9c4559c4ca1c4c6c3ec7ef2bf2592ebb8e754fde149dc78c1404a3a3
TLSH
T10BB012BE08A70C4EC6554F01150A308065607042D7C29400B3C403B0740CD30C700318
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_3256_e5acc3a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_3256_e5acc3a.txt
Size 112B
SHA256 cd63b5dcc7e7112d9d32834dab13267b46180b460c93974c383cdc026b4a69ad
MD5 d559a3b732d0ed56824990da36d2c06f
SHA1 1f06a19b7839a6d587f558571b1fdcbb79113fa5
SHA512 930a0919525a62b777cc73b99f513ca9a4859888c2de2bee3bab983f98b3e30b113e92766fad84433ee70c8aec7d5aeebb1bd1717a4da3922b2f9cbb1b02e0b7
TLSH
T195B012BE08AB0C4EC6654F01250F34C06560B443D7C29481B7D803F0740CF32CF00318
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1244-45-0x000001D9A5930000-0x000001D9A62D4000-memory.dmp

Download

memory/1244-35-0x000001D9A5930000-0x000001D9A62D4000-memory.dmp

Download

memory/3256-36-0x00000000060B0000-0x00000000060CE000-memory.dmp

Download

memory/3256-39-0x0000000007A70000-0x00000000080EC000-memory.dmp

Download

memory/3256-43-0x00000000080F0000-0x00000000086AA000-memory.dmp

Download

memory/3256-42-0x00000000072D0000-0x00000000072F2000-memory.dmp

Download

memory/3256-41-0x0000000007330000-0x00000000073C6000-memory.dmp

Download

memory/3256-40-0x0000000006880000-0x000000000689A000-memory.dmp

Download

memory/3256-26-0x0000000004DE0000-0x0000000004E16000-memory.dmp

Download

memory/3256-27-0x00000000054A0000-0x0000000005AEA000-memory.dmp

Download

memory/3256-28-0x00000000052E0000-0x0000000005302000-memory.dmp

Download

memory/3256-30-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/3256-29-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Download

memory/3256-33-0x0000000005BD0000-0x0000000005F2B000-memory.dmp

Download

memory/3256-37-0x0000000006580000-0x00000000065CC000-memory.dmp

Download

memory/3480-22-0x00000228BA8C0000-0x00000228BB264000-memory.dmp

Download

memory/4500-47-0x0000000002480000-0x00000000024C0000-memory.dmp

Download

memory/4500-64-0x0000000004F10000-0x0000000004F4C000-memory.dmp

Download

memory/4500-51-0x0000000010000000-0x0000000010040000-memory.dmp

Download

memory/4500-63-0x0000000004F10000-0x0000000004F4C000-memory.dmp

Download

memory/4500-66-0x0000000002480000-0x00000000024C0000-memory.dmp

Download

memory/4904-13-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-1-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-12-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-5-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-9-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-7-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-0-0x000002E480ADC000-0x000002E480ADD000-memory.dmp

Download

memory/4904-6-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-15-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/4904-4-0x000002E4FFC80000-0x000002E4FFCA2000-memory.dmp

Download

memory/4904-38-0x000002E480340000-0x000002E480CE4000-memory.dmp

Download

memory/5728-70-0x0000000004E10000-0x0000000004E52000-memory.dmp

Download

memory/5728-72-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/5728-67-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/5728-77-0x0000000005D70000-0x0000000005E02000-memory.dmp

Download

memory/5728-78-0x0000000005E10000-0x0000000005E60000-memory.dmp

Download

memory/5728-79-0x0000000005D40000-0x0000000005D4A000-memory.dmp

Download