Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 19:05

General

  • Target

    19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe

  • Size

    2.5MB

  • MD5

    764f4baced7ef6823e658d10cf71b392

  • SHA1

    e8c24ea84679d6cf8ed4dd1dff934edecd63fb81

  • SHA256

    19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d

  • SHA512

    174a27d27e358f4e9c1f6f82e694e1ed86857e7abb34a1f4ad964cc3990f6267f91ff7ea5ca4469b0ac6956f43de652a176194244f3d801789e778fbae2b4e85

  • SSDEEP

    49152:6Hyjtk2MYC5GDIHyjtk2MYC5GDhEh5Cenun9:6mtk2aZmtk2aiQCenun9

Malware Config

Signatures

  • Detect Neshta payload 30 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 41 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe
    "C:\Users\Admin\AppData\Local\Temp\19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\3582-490\19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Users\Admin\AppData\Local\Temp\._cache_19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2680
            • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
              "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
              6⤵
              • Executes dropped EXE
              PID:2284
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1512
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1916
              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate
                7⤵
                • Executes dropped EXE
                PID:1860
              • C:\ProgramData\Synaptics\Synaptics.exe
                "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1820
                • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of WriteProcessMemory
                  PID:2296
                  • C:\Windows\svchost.com
                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2992
                    • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                      C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1696
                      • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
                        "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate
                        11⤵
                        • Executes dropped EXE
                        PID:1568
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2956
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
    Filesize

    859KB

    MD5

    02ee6a3424782531461fb2f10713d3c1

    SHA1

    b581a2c365d93ebb629e8363fd9f69afc673123f

    SHA256

    ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

    SHA512

    6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

  • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
    Filesize

    547KB

    MD5

    cf6c595d3e5e9667667af096762fd9c4

    SHA1

    9bb44da8d7f6457099cb56e4f7d1026963dce7ce

    SHA256

    593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

    SHA512

    ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

  • C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
    Filesize

    186KB

    MD5

    58b58875a50a0d8b5e7be7d6ac685164

    SHA1

    1e0b89c1b2585c76e758e9141b846ed4477b0662

    SHA256

    2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

    SHA512

    d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

  • C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
    Filesize

    1.1MB

    MD5

    566ed4f62fdc96f175afedd811fa0370

    SHA1

    d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

    SHA256

    e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

    SHA512

    cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE
    Filesize

    285KB

    MD5

    831270ac3db358cdbef5535b0b3a44e6

    SHA1

    c0423685c09bbe465f6bb7f8672c936e768f05a3

    SHA256

    a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0

    SHA512

    f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE
    Filesize

    569KB

    MD5

    eef2f834c8d65585af63916d23b07c36

    SHA1

    8cb85449d2cdb21bd6def735e1833c8408b8a9c6

    SHA256

    3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd

    SHA512

    2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

  • C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe
    Filesize

    381KB

    MD5

    3ec4922dbca2d07815cf28144193ded9

    SHA1

    75cda36469743fbc292da2684e76a26473f04a6d

    SHA256

    0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801

    SHA512

    956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

  • C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE
    Filesize

    439KB

    MD5

    400836f307cf7dbfb469cefd3b0391e7

    SHA1

    7af3cbb12d3b2d8b5d9553c687c6129d1dd90a10

    SHA256

    cb5c5abb625a812d47007c75e3855be3f29da527a41cf03730ad5c81f3eb629a

    SHA512

    aa53cb304478585d6f83b19a6de4a7938ba2570d380a565a56ff5365aed073d5f56b95ad3228eb7d1e7e6110c6172a58b97bd6a5e57e4a8d39e762ed31dc17c8

  • C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE
    Filesize

    1.7MB

    MD5

    338f328b613632e6df24a00a49864835

    SHA1

    249a3f7c546aa66d98c4fbda2001bc649bc80013

    SHA256

    da5cc08eb0aa368f19ce481b3f9236203a6f40303d77ad30b94912dba22ca08d

    SHA512

    f59dc126be5bf72f802e6681f5af30ce947d7ad6e6b506612c8d6b49e2a5e2d597838311c474fd59e0b976453cf389cecb5443971019b307f2b52a1564ae69a8

  • C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE
    Filesize

    606KB

    MD5

    9b1c9f74ac985eab6f8e5b27441a757b

    SHA1

    9a2cf7d2518c5f5db405e5bd8d37bf62dcaf34f5

    SHA256

    2a189b995a7283b503bb5864dd9ca57976b3812a6a34aaf89a7551336c43bc24

    SHA512

    d72e83aeaf1d34627a6c6aa469821af8a8d464a72c764fbb064484adea509a8c1d3628e2166859286e84daae8ebdf4f800693ce203984a8c313b1f2263e101c4

  • C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
    Filesize

    674KB

    MD5

    9c10a5ec52c145d340df7eafdb69c478

    SHA1

    57f3d99e41d123ad5f185fc21454367a7285db42

    SHA256

    ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

    SHA512

    2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

  • C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
    Filesize

    485KB

    MD5

    87f15006aea3b4433e226882a56f188d

    SHA1

    e3ad6beb8229af62b0824151dbf546c0506d4f65

    SHA256

    8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

    SHA512

    b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

  • C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
    Filesize

    495KB

    MD5

    07e194ce831b1846111eb6c8b176c86e

    SHA1

    b9c83ec3b0949cb661878fb1a8b43a073e15baf1

    SHA256

    d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac

    SHA512

    55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

  • C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
    Filesize

    485KB

    MD5

    86749cd13537a694795be5d87ef7106d

    SHA1

    538030845680a8be8219618daee29e368dc1e06c

    SHA256

    8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

    SHA512

    7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

  • C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
    Filesize

    674KB

    MD5

    97510a7d9bf0811a6ea89fad85a9f3f3

    SHA1

    2ac0c49b66a92789be65580a38ae9798237711db

    SHA256

    c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

    SHA512

    2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

  • C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
    Filesize

    536KB

    MD5

    349c6f2f4e32553e8fea4d29772e40e6

    SHA1

    e2f7856aa519006f8cbc9943cc3fb34c4461932d

    SHA256

    7c4fd44a9cda339ac3e7fa93b0b2a24b1e0ac16996dbb19cfdcd6323170b1fd3

    SHA512

    0b9f9aafb1a682f9e5a5dccae0dc19e3cf21c5d2aa4df3e22311f5744255f668e9a1e11ee21f2656d9f45236c484e0b7b460a57db1c34f2d344bd4cbece42588

  • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
    Filesize

    266KB

    MD5

    c08ebf3a175b66593b27a3c071df5115

    SHA1

    4acafe7abdf85c922cac6065c9e4d0c909c22c85

    SHA256

    1a7cebff8a5859fcd9847bef3695ee9f8d29ddca361d8f52a6b23d824deba968

    SHA512

    79b17d05ebc6e5b17f25f0ce1c202e1ef4c959246073e1b242edc4c4c45a2bcf4b3ffac2f01f4394112eadc961c6b8934208a071658493ef7a7c34e810e567a9

  • C:\Users\Admin\AppData\Local\Temp\3582-490\19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe
    Filesize

    2.5MB

    MD5

    44cce607c901188b1ceca88705a3edfb

    SHA1

    104192763c1994a8686e1b813dde36109e83a1b6

    SHA256

    f85efbd3d02c72fc85aabcf5549b6803fd9968cc301dbf7dc4c745c3d3da1309

    SHA512

    1a4116c0fbb63cdf1ac1ab30b542286e501b2d94e9090ef0812d2b8c5a076c9a1b83295f3d333929df72c47e97faac683db473c74d915e8452a83b0d9492bdab

  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
    Filesize

    1.3MB

    MD5

    94e5f271b702947d8c96c432a77e99e7

    SHA1

    a284a7fb14c9576a380052f16e1aadf4c82a2105

    SHA256

    a3c7ec7dbd6ef0b778f0f05e140b965f5c1af8bce1a729ed5f8e183822dc10b9

    SHA512

    60dfef773155ce6a70b3c37f08c9d210fb4e9ae6aba4ed2b230ec1577f5484fd154cfbe27de7dd795ec171c6d24814813f89165d7011f14a224d64a2bf1dcb71

  • C:\Windows\directx.sys
    Filesize

    57B

    MD5

    56abc40d1e45c091d8afddb90a4ce6b4

    SHA1

    08db549484467b32b79958700300cabefc659848

    SHA256

    a43fa861957415e3b0f25e2b54d931961cd309ff1d5354a9362852895b90b3e1

    SHA512

    51625c015a7c8fcf6fb51d3396aa08d2068772e3fcacaf32c409e82071af4ba1eb2ee94f36c06a98c32ba59d23bbaa6b540f7bd418a9472303cc225151daa698

  • C:\Windows\svchost.com
    Filesize

    40KB

    MD5

    2ff724ca136d4a831421dfd891e167c6

    SHA1

    5416f8de17ae4a8d9ea2e2d4570c5dd9ba7e5eb8

    SHA256

    ff787f8231bb6f6a30eb61f46d56920e742ae22dd047622f8fbe6266d8bb864d

    SHA512

    5ad202eb3222b9a95695ee1ffcebdaa3cd7235dbc8a1bf845e560736f514d9d7c92bc509c7089f53ff391bcd1d053050ccf0d889102a2b53b373d211dfbd9dc0

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

  • \Users\Admin\AppData\Local\Temp\._cache_19080603ce869f54525b8740d18dca57ee1cbc2ee4d52a4a17d1ec4963047b9d.exe
    Filesize

    1.4MB

    MD5

    c6b7d88af09bed8ef817c3ad1f68f9f4

    SHA1

    c49df92061197098f62c7e5031e8b9ce406d911c

    SHA256

    b116d954ddce3d3df3ef09a44aac5433c91ea2fee317dbf33fc5c4e5cec06af5

    SHA512

    75452e228ccfc14f144d4ce777b5898ace42ca5638c2607cc00b1dd1ba1ff05e3074af33bfad39979b0e3b035daad4a7503a1c88f3c3a5ecf2ce3266d0a33c2d

  • memory/1140-54-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1512-133-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1696-246-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1696-296-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1696-252-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1696-256-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1696-254-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1820-293-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1820-245-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1820-289-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1916-213-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/1928-243-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1928-248-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/2164-14-0x0000000000220000-0x0000000000221000-memory.dmp
    Filesize

    4KB

  • memory/2164-82-0x0000000000400000-0x0000000000680000-memory.dmp
    Filesize

    2.5MB

  • memory/2284-106-0x0000000000A70000-0x0000000000AB8000-memory.dmp
    Filesize

    288KB

  • memory/2296-217-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/2308-154-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/2572-180-0x0000000000400000-0x0000000000680000-memory.dmp
    Filesize

    2.5MB

  • memory/2680-76-0x0000000000400000-0x000000000055F000-memory.dmp
    Filesize

    1.4MB

  • memory/2932-250-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/2932-244-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/2956-212-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/2992-223-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB