neshta | 6dd5d1309948dac371cf1cc1083f758ea313161d8658d9d3842e3f908bd280d5

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Invoice and receipt.exe
Size

727KB
MD5

b4b32117b40b70fb1bfeab298ba44557
SHA1

a74707a387129c37ce14a7ebacd053a8864e2e7d
SHA256

6dd5d1309948dac371cf1cc1083f758ea313161d8658d9d3842e3f908bd280d5
SHA512

dbd3f35c3c6b3ebe18276672a607475d0a8a9999b1e666256a7dac3994367c35887109ba8e1106ea04eb2574d387ce9e198d7d2ac0b33fa85865850fad507906
SSDEEP

12288:61ta/jCVo69W+WkpmDodcb1NrOvPA/cxSgDXwJWTrDVylYtnh:g8/jCa69DpOodcbnrOw0ZwJWTrpUYL

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 6 IoCs

resource	yara_rule
behavioral2/memory/1696-26-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1696-27-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1696-35-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1696-42-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1696-198-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1696-200-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	Invoice and receipt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	Invoice and receipt.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Invoice and receipt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 1696	1660	Invoice and receipt.exe	95

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~2.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~3.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	Invoice and receipt.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	Invoice and receipt.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	Invoice and receipt.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	Invoice and receipt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3308	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Invoice and receipt.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1440	powershell.exe
1936	powershell.exe
1440	powershell.exe
1936	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1440	1660	Invoice and receipt.exe	89
PID 1660 wrote to memory of 1440	1660	Invoice and receipt.exe	89
PID 1660 wrote to memory of 1440	1660	Invoice and receipt.exe	89
PID 1660 wrote to memory of 1936	1660	Invoice and receipt.exe	91
PID 1660 wrote to memory of 1936	1660	Invoice and receipt.exe	91
PID 1660 wrote to memory of 1936	1660	Invoice and receipt.exe	91
PID 1660 wrote to memory of 3308	1660	Invoice and receipt.exe	93
PID 1660 wrote to memory of 3308	1660	Invoice and receipt.exe	93
PID 1660 wrote to memory of 3308	1660	Invoice and receipt.exe	93
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95
PID 1660 wrote to memory of 1696	1660	Invoice and receipt.exe	95

C:\Users\Admin\AppData\Local\Temp\Invoice and receipt.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice and receipt.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Invoice and receipt.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PKgJBVbBBXr.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PKgJBVbBBXr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAFF7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3308
- C:\Users\Admin\AppData\Local\Temp\Invoice and receipt.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice and receipt.exe"
  2⤵
  - Checks computer location settings
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Filesize
328KB

MD5
aae23b4002755be35da73d5aa597bdc5

SHA1
93e3bb7907649f0db55fb5ba50586ff73095de6c

SHA256
f78a9f80d2009989ba1a18efe735164654990e82347e506060d23923635cede8

SHA512
01238e816d4084d61387e599a2d838371c496cc068e4228a60b2723837b27a16746870e38e1ea0770f211f19a6209b0ca33b493dcdc244ca65ccd4a4d10f93ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ac0601449f945fbbe46be72ba77b6b26

SHA1
eb573788c1a36970cc2beb6a1859725da9364cf2

SHA256
db0273c2ee659047e7f7b952d356cf5ec21f7ac55db276dea102acf3862f107a

SHA512
5c82a1dd4a95ce81e59f4e7619e6817ef4b53c6d2bf70e58bf92fdc4ac285a34b89877d42d9a7c5e6a72eea0c510adf8028184bc92af7d6959b4fd407ba05b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\Invoice and receipt.exe

Filesize
686KB

MD5
3fa00cbe354dd01d622f28366fce6d25

SHA1
6657afd146e6f5cf936e1241a37b7003b144c8b8

SHA256
7778a8371c01ac5d13f4d79626d081c6df59600701371ff168ee50bf7cf318a0

SHA512
149098235d0e573b65846074e5ef44ef230d368497eb9abc546e5a0c37bb7670c6f48531b31ee6d33a4d9e200bfb8c467b0d68f7bb2b2ae0c2e2e51eadbc5b5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_naue4urx.cj3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAFF7.tmp

Filesize
1KB

MD5
cbf294162f7dfd689ee2a5bb57046cb6

SHA1
b075da25e1b7a13d2f977af9bae2393665d2a4b9

SHA256
d1c9a5e15fefae410de80a5aa41a1fe9c7a65cd6d37d49b6ce718c005f0d1bf7

SHA512
bea49f44376f57d9632b24c456196ec6a261605d2f0c5d6b82c84f4529de820be3af1803cfbb0232b076caa8812024fc2a0f704e5536720751449621ccc2f7b2

Download Submit
C:\Users\Admin\AppData\Roaming\PKGJBV~1.EXE

Filesize
727KB

MD5
b4b32117b40b70fb1bfeab298ba44557

SHA1
a74707a387129c37ce14a7ebacd053a8864e2e7d

SHA256
6dd5d1309948dac371cf1cc1083f758ea313161d8658d9d3842e3f908bd280d5

SHA512
dbd3f35c3c6b3ebe18276672a607475d0a8a9999b1e666256a7dac3994367c35887109ba8e1106ea04eb2574d387ce9e198d7d2ac0b33fa85865850fad507906

Download Submit
memory/1440-41-0x0000000006380000-0x00000000063E6000-memory.dmp

Filesize
408KB

Download
memory/1440-20-0x0000000005BE0000-0x0000000006208000-memory.dmp

Filesize
6.2MB

Download
memory/1440-70-0x00000000078B0000-0x00000000078E2000-memory.dmp

Filesize
200KB

Download
memory/1440-68-0x00000000055A0000-0x00000000055B0000-memory.dmp

Filesize
64KB

Download
memory/1440-71-0x00000000706A0000-0x00000000706EC000-memory.dmp

Filesize
304KB

Download
memory/1440-17-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1440-16-0x0000000002FB0000-0x0000000002FE6000-memory.dmp

Filesize
216KB

Download
memory/1440-18-0x00000000055A0000-0x00000000055B0000-memory.dmp

Filesize
64KB

Download
memory/1440-19-0x00000000055A0000-0x00000000055B0000-memory.dmp

Filesize
64KB

Download
memory/1440-29-0x0000000005A20000-0x0000000005A42000-memory.dmp

Filesize
136KB

Download
memory/1440-66-0x00000000069C0000-0x0000000006A0C000-memory.dmp

Filesize
304KB

Download
memory/1440-82-0x0000000007890000-0x00000000078AE000-memory.dmp

Filesize
120KB

Download
memory/1440-165-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1440-93-0x0000000008270000-0x00000000088EA000-memory.dmp

Filesize
6.5MB

Download
memory/1440-43-0x0000000006500000-0x0000000006566000-memory.dmp

Filesize
408KB

Download
memory/1440-69-0x000000007F030000-0x000000007F040000-memory.dmp

Filesize
64KB

Download
memory/1440-148-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1660-24-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1660-6-0x0000000006A70000-0x0000000006B18000-memory.dmp

Filesize
672KB

Download
memory/1660-3-0x0000000005850000-0x00000000058E2000-memory.dmp

Filesize
584KB

Download
memory/1660-4-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/1660-45-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/1660-44-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1660-8-0x0000000005AB0000-0x0000000005AB8000-memory.dmp

Filesize
32KB

Download
memory/1660-0-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1660-2-0x0000000005EC0000-0x0000000006464000-memory.dmp

Filesize
5.6MB

Download
memory/1660-5-0x0000000005800000-0x000000000580A000-memory.dmp

Filesize
40KB

Download
memory/1660-1-0x0000000000D90000-0x0000000000E4A000-memory.dmp

Filesize
744KB

Download
memory/1660-7-0x0000000005A50000-0x0000000005A62000-memory.dmp

Filesize
72KB

Download
memory/1660-11-0x0000000009330000-0x00000000093CC000-memory.dmp

Filesize
624KB

Download
memory/1660-10-0x0000000006BB0000-0x0000000006C3C000-memory.dmp

Filesize
560KB

Download
memory/1660-9-0x0000000005AC0000-0x0000000005ACC000-memory.dmp

Filesize
48KB

Download
memory/1696-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1696-42-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1696-200-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1696-198-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1696-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1696-35-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-94-0x0000000007660000-0x000000000767A000-memory.dmp

Filesize
104KB

Download
memory/1936-55-0x0000000005D10000-0x0000000006064000-memory.dmp

Filesize
3.3MB

Download
memory/1936-96-0x00000000078E0000-0x0000000007976000-memory.dmp

Filesize
600KB

Download
memory/1936-97-0x0000000007860000-0x0000000007871000-memory.dmp

Filesize
68KB

Download
memory/1936-72-0x00000000706A0000-0x00000000706EC000-memory.dmp

Filesize
304KB

Download
memory/1936-112-0x0000000007890000-0x000000000789E000-memory.dmp

Filesize
56KB

Download
memory/1936-113-0x00000000078A0000-0x00000000078B4000-memory.dmp

Filesize
80KB

Download
memory/1936-114-0x00000000079A0000-0x00000000079BA000-memory.dmp

Filesize
104KB

Download
memory/1936-115-0x0000000007980000-0x0000000007988000-memory.dmp

Filesize
32KB

Download
memory/1936-95-0x00000000076D0000-0x00000000076DA000-memory.dmp

Filesize
40KB

Download
memory/1936-92-0x0000000007530000-0x00000000075D3000-memory.dmp

Filesize
652KB

Download
memory/1936-25-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/1936-161-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1936-23-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download
memory/1936-22-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/1936-62-0x0000000006330000-0x000000000634E000-memory.dmp

Filesize
120KB

Download
memory/1936-67-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Filesize
64KB

Download