agenttesla | 3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe
Size

308KB
MD5

1ee185cb3b4f78f2a24e61798952178b
SHA1

8049b95b5250bad311950a218de4b9727e8f4579
SHA256

3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243
SHA512

d16938efe9ec9936266e9c37b9c85b5f26cdfc66cc9c552186c3973ebed1c7e9f0f9f380f39cc113c03e7983dd9188a5e7292115748d78953101cfd359f0a93f
SSDEEP

3072:iOvQ/IaGuDfIeqpMTxV/wP8rjAILNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbO:FQIZe+MFVXx9stvLGtELbMUTKZ1H

Score

10^/10

agenttesla asyncrat zgrat april3rd2024 keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

April3rd2024

94.156.65.181:3434

Mutex

A234sdgrgMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2904-3-0x00000000085F0000-0x0000000008826000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-4-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-7-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-15-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-25-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-23-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-21-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-19-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-17-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-13-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-11-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-9-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-5-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-27-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-37-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-61-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-67-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-65-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-63-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-59-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-57-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-55-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-53-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-51-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-49-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-47-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-45-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-43-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-41-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-39-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-35-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-33-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-31-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-29-0x00000000085F0000-0x0000000008820000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Async RAT payload 1 IoCs
rat

Processes:

resource yara_rule

\Users\Admin\AppData\Local\Temp\FB_BC9C.tmp.exe family_asyncrat

resource	yara_rule
\Users\Admin\AppData\Local\Temp\FB_BC9C.tmp.exe	family_asyncrat

Detect packed .NET executables. Mostly AgentTeslaV4. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp	INDICATOR_EXE_Packed_GEN01
\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/3500-4923-0x0000000000D40000-0x0000000000D82000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/3500-4923-0x0000000000D40000-0x0000000000D82000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/3500-4923-0x0000000000D40000-0x0000000000D82000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/3500-4923-0x0000000000D40000-0x0000000000D82000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/3500-4923-0x0000000000D40000-0x0000000000D82000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/3500-4923-0x0000000000D40000-0x0000000000D82000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Detects file containing reversed ASEP Autorun registry keys 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
\Users\Admin\AppData\Local\Temp\FB_BC9C.tmp.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral1/memory/3536-4925-0x0000000000220000-0x0000000000232000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Executes dropped EXE 2 IoCs

Processes:

FB_BB63.tmp.exeFB_BC9C.tmp.exe

pid process

3500 FB_BB63.tmp.exe
3536 FB_BC9C.tmp.exe
Loads dropped DLL 2 IoCs

Processes:

RegAsm.exe

pid process

3384 RegAsm.exe
3384 RegAsm.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3500	FB_BB63.tmp.exe
3536	FB_BC9C.tmp.exe

pid	process
3384	RegAsm.exe
3384	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\savef = "C:\\Users\\Admin\\AppData\\Roaming\\savef.exe"	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe

description pid process target process

PID 2904 set thread context of 3384 2904 3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

FB_BB63.tmp.exe

pid process

3500 FB_BB63.tmp.exe
3500 FB_BB63.tmp.exe

flow	ioc
3	api.ipify.org
4	api.ipify.org

description	pid	process	target process
PID 2904 set thread context of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe

pid	process
3500	FB_BB63.tmp.exe
3500	FB_BB63.tmp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exeFB_BB63.tmp.exeFB_BC9C.tmp.exe

description	pid	process
Token: SeDebugPrivilege	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe
Token: SeDebugPrivilege	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe
Token: SeDebugPrivilege	3500	FB_BB63.tmp.exe
Token: SeDebugPrivilege	3536	FB_BC9C.tmp.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exeRegAsm.exe

description	pid	process	target process
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 2904 wrote to memory of 3384	2904	3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe	RegAsm.exe
PID 3384 wrote to memory of 3500	3384	RegAsm.exe	FB_BB63.tmp.exe
PID 3384 wrote to memory of 3500	3384	RegAsm.exe	FB_BB63.tmp.exe
PID 3384 wrote to memory of 3500	3384	RegAsm.exe	FB_BB63.tmp.exe
PID 3384 wrote to memory of 3500	3384	RegAsm.exe	FB_BB63.tmp.exe
PID 3384 wrote to memory of 3536	3384	RegAsm.exe	FB_BC9C.tmp.exe
PID 3384 wrote to memory of 3536	3384	RegAsm.exe	FB_BC9C.tmp.exe
PID 3384 wrote to memory of 3536	3384	RegAsm.exe	FB_BC9C.tmp.exe
PID 3384 wrote to memory of 3536	3384	RegAsm.exe	FB_BC9C.tmp.exe

C:\Users\Admin\AppData\Local\Temp\3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe
"C:\Users\Admin\AppData\Local\Temp\3d75eede311931faf4dc46008199f7dc49a42237388ac8471c3a5a07432fb243.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3384

C:\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Users\Admin\AppData\Local\Temp\FB_BC9C.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\FB_BC9C.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3536

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab2B85.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
\Users\Admin\AppData\Local\Temp\FB_BB63.tmp.exe
Filesize
237KB

MD5
8c4c985b5719d0acadafb2cc03f0e86e

SHA1
0e0644087a29575b5c4a1d3b76a79cf95c577d7b

SHA256
a2007da837ca22cd0e894946f9ce20a3352ac42c34c5930c159730ea4538e79b

SHA512
8255101de0ed591128c5d093cd683193a24f5044fc297e6e51ae58714b121164b480c9868c477c24d653a231dc17db4c5f78de9ccc084e14133cc95e14e6219c

Download Submit
\Users\Admin\AppData\Local\Temp\FB_BC9C.tmp.exe
Filesize
45KB

MD5
ac190c9e687b2c110354d3809d32a57d

SHA1
3fdfeca134e469f6ac42e03b3d39359313fb36fc

SHA256
6c0291916555438da7d3705991100d295d480ae58b98147a4d83fbd3cfb8dc19

SHA512
161ae735acf5b60c6c906c1b0223838987a24cbb410623af2495b31e2e663561a6ecf1ad5f08956a6fb2134ebd32aaaa1573bae7e1c4abdfb7fb0ca8b2a9ecb5

Download Submit
memory/2904-0-0x000000007420E000-0x000000007420F000-memory.dmp

Filesize
4KB

Download
memory/2904-1-0x0000000000F40000-0x0000000000F90000-memory.dmp

Filesize
320KB

Download
memory/2904-2-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-3-0x00000000085F0000-0x0000000008826000-memory.dmp

Filesize
2.2MB

Download
memory/2904-4-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-7-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-15-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-25-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-23-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-21-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-19-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-17-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-13-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-11-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-9-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-5-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-27-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-37-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-61-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-67-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-65-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-63-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-59-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-57-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-55-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-53-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-51-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-49-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-47-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-45-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-43-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-41-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-39-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-35-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-33-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-31-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-29-0x00000000085F0000-0x0000000008820000-memory.dmp

Filesize
2.2MB

Download
memory/2904-4885-0x00000000057E0000-0x000000000582C000-memory.dmp

Filesize
304KB

Download
memory/2904-4884-0x00000000052A0000-0x0000000005312000-memory.dmp

Filesize
456KB

Download
memory/2904-4886-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-4887-0x000000007420E000-0x000000007420F000-memory.dmp

Filesize
4KB

Download
memory/2904-4888-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-4889-0x0000000005530000-0x0000000005584000-memory.dmp

Filesize
336KB

Download
memory/2904-4909-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/3384-4910-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3500-4923-0x0000000000D40000-0x0000000000D82000-memory.dmp

Filesize
264KB

Download
memory/3536-4925-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download