neshta | 2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:06

Sharing

Report Analysis Logs

General

Target

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
Size

784KB
MD5

700995e915a6a8b1d62ef701d10113ac
SHA1

e31d7d13f6151ba921e978a70dcce67255addeb6
SHA256

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18
SHA512

75ed48ddc399abf2f573d9d7dc15988938f48d62bf7d7b45a20da8279003cf8c22206b02de008055e5f9c39d6f40d66ccade1f1f7c26c77859580cd26c902551
SSDEEP

24576:Hn698VVY+Kp1qXSAfzW9zulnqLmkrOOm:a9SLXTWEnq3OOm

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2512-16-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2512-18-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2512-20-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2512-17-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2512-94-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

Modify Registry

Change Default File Association

Processes:

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

description	pid	process	target process
PID 1660 set thread context of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

Drops file in Program Files directory 64 IoCs

Processes:

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

Drops file in Windows directory 1 IoCs

Processes:

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

description ioc process

File opened for modification C:\Windows\svchost.com 2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

description	pid	process	target process
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
PID 1660 wrote to memory of 2512	1660	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe	2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe

C:\Users\Admin\AppData\Local\Temp\2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
"C:\Users\Admin\AppData\Local\Temp\2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe
"C:\Users\Admin\AppData\Local\Temp\2c71c987526332f38fe4485dfa0f6134ba4ec24a809d95877a0bba9549883e18.exe"
2⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
b7c843620d233b8c30a6514860297225

SHA1
292e6dd68b24c7945c4d3fbcbff7458fd61fb7a8

SHA256
3b270fa3f72584ed8e7d4680a04dfad88219f042f05f6711b17f2a1e08d5d474

SHA512
e68e66578b5455da52aa55a3cdaef13ae9ba9ea0816d478213a82f60a9972de2eb3e9619d4db7cab2e7e97a92778203c7f606f4ba43eb13481b79db8c1561c28

Download Submit
memory/1660-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

Filesize
4KB

Download
memory/1660-1-0x00000000008F0000-0x00000000009B8000-memory.dmp

Filesize
800KB

Download
memory/1660-2-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/1660-3-0x00000000005A0000-0x00000000005C2000-memory.dmp

Filesize
136KB

Download
memory/1660-4-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1660-5-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/1660-6-0x00000000059E0000-0x0000000005A6C000-memory.dmp

Filesize
560KB

Download
memory/1660-21-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2512-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2512-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-20-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-11-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-10-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-16-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2512-94-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download