neshta | 7abc1b8fa874b4404c929fb286e8d9b14a431e56e4ade13833390e1f9e3baf19

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA of March.exe
Size 728KB
Sample240416-d775csad7x
SHA256 75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9
MD5 2f8cf1eacce33f87429c022d57a1ebea
SHA1 a9ebe3f2e6de49eda0493cbae362d2b033461243
SHA512 54f9afe991c68b7083db5e4b514bfa693a63e1d4d40f94d0d4e95b0a545252bffb3acb8a38f84621cadfb7aa1126a91d579cddef254a2f4b318450e3f9af8f18
SSDEEP 12288:mtOoZILRpev2DcHXpER+tNEty+8vzCxrml3bREqKzztrXWqahU5/R7tOjaAqVh6g:muJD+XqRuKtsbCxKl3b2qkhWRi/RBOja
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 6 IoCs

resource	yara_rule
behavioral2/memory/1884-45-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1884-49-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1884-38-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1884-37-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1884-194-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1884-196-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	SOA of March.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	SOA of March.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	SOA of March.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3944 set thread context of 1884	3944	SOA of March.exe	97

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~3.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI9C33~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~2.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	SOA of March.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	SOA of March.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	SOA of March.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4024	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	SOA of March.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4656	powershell.exe
2884	powershell.exe
4656	powershell.exe
2884	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4656	3944	SOA of March.exe	91
PID 3944 wrote to memory of 4656	3944	SOA of March.exe	91
PID 3944 wrote to memory of 4656	3944	SOA of March.exe	91
PID 3944 wrote to memory of 2884	3944	SOA of March.exe	93
PID 3944 wrote to memory of 2884	3944	SOA of March.exe	93
PID 3944 wrote to memory of 2884	3944	SOA of March.exe	93
PID 3944 wrote to memory of 4024	3944	SOA of March.exe	95
PID 3944 wrote to memory of 4024	3944	SOA of March.exe	95
PID 3944 wrote to memory of 4024	3944	SOA of March.exe	95
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97
PID 3944 wrote to memory of 1884	3944	SOA of March.exe	97

C:\Users\Admin\AppData\Local\Temp\SOA of March.exe
"C:\Users\Admin\AppData\Local\Temp\SOA of March.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA of March.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fxIsxsw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fxIsxsw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A26.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4024
- C:\Users\Admin\AppData\Local\Temp\SOA of March.exe
  "C:\Users\Admin\AppData\Local\Temp\SOA of March.exe"
  2⤵
  - Checks computer location settings
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 5517b70a239e535f85a736e87c5deddec7dc48cb661cb042c51856d24abcd337
MD5 663ed8b7c46f3b72587318e591f4a361
SHA1 c44d4014b06be83fadaa9c5a47ce00b18af69969
SHA512 274a4d9707c66acb916e1fdaeded258319dff6e334242534bd19a6324766985a5c145cc65097020302029c2957b8534f10bbadb1ba1c6d0a59500b013b9a0afd
SSDEEP 6144:ZfsRnX5f6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:mtF6exwI1oB8RZ4Q5VYH
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 18ed27512a21e119f587f94310762f19570af7621a5955fabcde5882d462f853
MD5 9777972d2acd2994c3414393392e86a5
SHA1 55f4cd2bf8c0e63fd55e8b831d2cdd3503cd5cc8
SHA512 4620c31b9335db37b0b88e451402d05c0d2a3c386ec0f750db468b40bc08f3363b1f6d68fbc803db24e5ccf4f94cb882669afcf9f07052a16ce851a22ad95c6c
SSDEEP 384:4sf+BO9i+yrOkBiDWrIR+o9o2dpK6seYLME/h03SoZCfYSg0jEDkeQ0gdItkKhD:VfqrOkoxRjo2dpNgrKSlWKEDjCq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SOA of March.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\SOA of March.exe
Size 688KB
SHA256 c5aac26124429fbf9712105ffae772d81190c6af63d241c92e0432f96da25f58
MD5 311fc7d3b1c40b9d54449b4438aec966
SHA1 9ade2bc2022780482f48903261241951561ca1ef
SHA512 81545eca187040fd181c62312cc8c29c4b51cacf8ff350b124caa2cb49034068b5e34dbe43aef79968ff735f5892049a1d6e5ba484cc4bc1d69eef0bd9f27e4f
SSDEEP 12288:woZILRpev2DcHXpER+tNEty+8vzCxrml3bREqKzztrXWqahU5/R7tOjaAqVh6bA6:2JD+XqRuKtsbCxKl3b2qkhWRi/RBOjDd
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_cvgaufny.nyf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cvgaufny.nyf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp5A26.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5A26.tmp
Size 1KB
SHA256 4c237fd4bcf55d6f4fd13e84dbd4e9d8bd213fbf69a045a9a2a51f5a10c3d7ba
MD5 fc32a5e7cc6decf6e28c52e2f815da88
SHA1 22b9d927b268d70e717b9afed6b99ec9e9ac4954
SHA512 0fae184127faace7804fcd4be0bdf2af6a4950df013e762b7a6e0dbf6cac19021ec4d11f211874df6da4d4102ab79c30f67e6d81d503321743a4bf0c7b0a735a
MD5 SHA1 SHA512

Submit Download

fxIsxsw.exe

Path C:\Users\Admin\AppData\Roaming\fxIsxsw.exe
Size 728KB
SHA256 75854947a6a21c6fdacee3b080ad9f9c8c86546b54410a968d6f09c23e5d00c9
MD5 2f8cf1eacce33f87429c022d57a1ebea
SHA1 a9ebe3f2e6de49eda0493cbae362d2b033461243
SHA512 54f9afe991c68b7083db5e4b514bfa693a63e1d4d40f94d0d4e95b0a545252bffb3acb8a38f84621cadfb7aa1126a91d579cddef254a2f4b318450e3f9af8f18
SSDEEP 12288:mtOoZILRpev2DcHXpER+tNEty+8vzCxrml3bREqKzztrXWqahU5/R7tOjaAqVh6g:muJD+XqRuKtsbCxKl3b2qkhWRi/RBOja
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1884-194-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1884-37-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1884-38-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1884-49-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1884-45-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1884-196-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2884-90-0x0000000007930000-0x0000000007FAA000-memory.dmp

Download

memory/2884-46-0x0000000005950000-0x0000000005CA4000-memory.dmp

Download

memory/2884-181-0x0000000074520000-0x0000000074CD0000-memory.dmp

Download

memory/2884-159-0x0000000007550000-0x0000000007558000-memory.dmp

Download

memory/2884-158-0x0000000007570000-0x000000000758A000-memory.dmp

Download

memory/2884-145-0x0000000007470000-0x0000000007484000-memory.dmp

Download

memory/2884-23-0x0000000074520000-0x0000000074CD0000-memory.dmp

Download

memory/2884-24-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/2884-25-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/2884-135-0x0000000007460000-0x000000000746E000-memory.dmp

Download

memory/2884-101-0x0000000007090000-0x000000000709A000-memory.dmp

Download

memory/2884-89-0x00000000026A0000-0x00000000026B0000-memory.dmp

Download

memory/2884-79-0x0000000070980000-0x00000000709CC000-memory.dmp

Download

memory/3944-47-0x0000000074520000-0x0000000074CD0000-memory.dmp

Download

memory/3944-0-0x0000000000DE0000-0x0000000000E9C000-memory.dmp

Download

memory/3944-11-0x00000000093C0000-0x000000000945C000-memory.dmp

Download

memory/3944-9-0x0000000005CC0000-0x0000000005CCC000-memory.dmp

Download

memory/3944-8-0x0000000005B90000-0x0000000005B98000-memory.dmp

Download

memory/3944-1-0x0000000074520000-0x0000000074CD0000-memory.dmp

Download

memory/3944-7-0x0000000005B60000-0x0000000005B72000-memory.dmp

Download

memory/3944-2-0x0000000005E30000-0x00000000063D4000-memory.dmp

Download

memory/3944-10-0x0000000006B70000-0x0000000006BFC000-memory.dmp

Download

memory/3944-3-0x0000000005880000-0x0000000005912000-memory.dmp

Download

memory/3944-4-0x00000000059E0000-0x00000000059F0000-memory.dmp

Download

memory/3944-5-0x0000000005930000-0x000000000593A000-memory.dmp

Download

memory/3944-6-0x0000000006F50000-0x0000000006FF8000-memory.dmp

Download

memory/4656-66-0x000000007F460000-0x000000007F470000-memory.dmp

Download

memory/4656-21-0x0000000004D10000-0x0000000004D32000-memory.dmp

Download

memory/4656-19-0x0000000004920000-0x0000000004930000-memory.dmp

Download

memory/4656-91-0x0000000006EF0000-0x0000000006F0A000-memory.dmp

Download

memory/4656-78-0x0000000006DF0000-0x0000000006E93000-memory.dmp

Download

memory/4656-32-0x0000000005770000-0x00000000057D6000-memory.dmp

Download

memory/4656-107-0x00000000073B0000-0x0000000007446000-memory.dmp

Download

memory/4656-108-0x0000000007310000-0x0000000007321000-memory.dmp

Download

memory/4656-26-0x0000000005700000-0x0000000005766000-memory.dmp

Download

memory/4656-16-0x0000000004870000-0x00000000048A6000-memory.dmp

Download

memory/4656-18-0x0000000004F60000-0x0000000005588000-memory.dmp

Download

memory/4656-20-0x0000000004920000-0x0000000004930000-memory.dmp

Download

memory/4656-177-0x0000000074520000-0x0000000074CD0000-memory.dmp

Download

memory/4656-77-0x0000000006300000-0x000000000631E000-memory.dmp

Download

memory/4656-67-0x0000000070980000-0x00000000709CC000-memory.dmp

Download

memory/4656-17-0x0000000074520000-0x0000000074CD0000-memory.dmp

Download

memory/4656-65-0x00000000063B0000-0x00000000063E2000-memory.dmp

Download

memory/4656-64-0x0000000006340000-0x000000000638C000-memory.dmp

Download

memory/4656-54-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Download