Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-10-2022 00:21

General

  • Target

    826aa9234de38f7df9471a96123353f3.exe

  • Size

    219KB

  • MD5

    826aa9234de38f7df9471a96123353f3

  • SHA1

    45385e79156656d8e78002241afb6c54f34d3c00

  • SHA256

    67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff

  • SHA512

    a62ba58c4de2e6a8e515e8a9f2271770a39ad9c9b35c2b593f85652aade60d2bc390ec5edf9053c437b79d1675fb03791d048c5ad06f432e673cb2b38b2d5456

  • SSDEEP

    3072:+ln05dgYTAGSoLODwl625PJyIkn7Vwe82D/neLO2S4zxAc983Nwhh4X/Ts:+l00EL/lgn7VwexD/eAQxmShh

Malware Config

Extracted

Family

danabot

Attributes
  • embedded_hash

    569235DCA8F16ED8310BBACCB674F896

  • type

    loader

Extracted

Family

vidar

Version

55.2

Botnet

937

C2

https://t.me/slivetalks

https://c.im/@xinibin420

Attributes
  • profile_id

    937

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 39 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 47 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\826aa9234de38f7df9471a96123353f3.exe
    "C:\Users\Admin\AppData\Local\Temp\826aa9234de38f7df9471a96123353f3.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2280
  • C:\Users\Admin\AppData\Local\Temp\59A9.exe
    C:\Users\Admin\AppData\Local\Temp\59A9.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3800
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:3756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 652
        2⤵
        • Program crash
        PID:1128
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 956
        2⤵
        • Program crash
        PID:4492
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 956
        2⤵
        • Program crash
        PID:4976
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 1004
        2⤵
        • Program crash
        PID:4176
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 964
        2⤵
        • Program crash
        PID:4760
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 1004
        2⤵
        • Program crash
        PID:3496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 1156
        2⤵
        • Program crash
        PID:4456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 1068
        2⤵
        • Program crash
        PID:4004
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1832
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 1428
        2⤵
        • Program crash
        PID:4552
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4344
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x500 0x450
      1⤵
        PID:376
      • C:\Users\Admin\AppData\Local\Temp\D79.exe
        C:\Users\Admin\AppData\Local\Temp\D79.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:3464
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\D79.exe" & exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 6
            3⤵
            • Delays execution with timeout.exe
            PID:1008
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 896
          2⤵
          • Program crash
          PID:2748
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3464 -ip 3464
        1⤵
          PID:5020
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3800 -ip 3800
          1⤵
            PID:1004
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3800 -ip 3800
            1⤵
              PID:4536
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3800 -ip 3800
              1⤵
                PID:2528
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3800 -ip 3800
                1⤵
                  PID:4780
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3800 -ip 3800
                  1⤵
                    PID:2316
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3800 -ip 3800
                    1⤵
                      PID:4420
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3800 -ip 3800
                      1⤵
                        PID:4852
                      • C:\Windows\system32\OpenWith.exe
                        C:\Windows\system32\OpenWith.exe -Embedding
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:2776
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3800 -ip 3800
                        1⤵
                          PID:2276
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3800 -ip 3800
                          1⤵
                            PID:5052

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Defense Evasion

                          Modify Registry

                          1
                          T1112

                          Credential Access

                          Credentials in Files

                          3
                          T1081

                          Discovery

                          Query Registry

                          4
                          T1012

                          System Information Discovery

                          4
                          T1082

                          Peripheral Device Discovery

                          1
                          T1120

                          Collection

                          Data from Local System

                          3
                          T1005

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\mozglue.dll
                            Filesize

                            593KB

                            MD5

                            c8fd9be83bc728cc04beffafc2907fe9

                            SHA1

                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                            SHA256

                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                            SHA512

                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          • C:\ProgramData\nss3.dll
                            Filesize

                            2.0MB

                            MD5

                            1cc453cdf74f31e4d913ff9c10acdde2

                            SHA1

                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                            SHA256

                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                            SHA512

                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          • C:\ProgramData\sqlite3.dll
                            Filesize

                            1.1MB

                            MD5

                            1f44d4d3087c2b202cf9c90ee9d04b0f

                            SHA1

                            106a3ebc9e39ab6ddb3ff987efb6527c956f192d

                            SHA256

                            4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260

                            SHA512

                            b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45

                          • C:\Users\Admin\AppData\Local\Temp\59A9.exe
                            Filesize

                            8.4MB

                            MD5

                            1f5a4d782148000437eca485f0c96f84

                            SHA1

                            bfd998befaf9835200fb42f16d3016fb5391ef23

                            SHA256

                            aa91dd8b42fa14bad304ac23a78b5ae726fc5824e14f5f89ed13601b8ea00596

                            SHA512

                            698160dc4c5dce49f18893c5fc8fbb2e88f963426fbd6e87cc518e82a0aca31d26362d4e1377ba0e7afd20b6fa24f2eddd7adf4dd1793b2e616055abacd0bde8

                          • C:\Users\Admin\AppData\Local\Temp\59A9.exe
                            Filesize

                            8.4MB

                            MD5

                            1f5a4d782148000437eca485f0c96f84

                            SHA1

                            bfd998befaf9835200fb42f16d3016fb5391ef23

                            SHA256

                            aa91dd8b42fa14bad304ac23a78b5ae726fc5824e14f5f89ed13601b8ea00596

                            SHA512

                            698160dc4c5dce49f18893c5fc8fbb2e88f963426fbd6e87cc518e82a0aca31d26362d4e1377ba0e7afd20b6fa24f2eddd7adf4dd1793b2e616055abacd0bde8

                          • C:\Users\Admin\AppData\Local\Temp\684259a6-0175-4108-a860-699cb31f63c2.tmp
                            Filesize

                            23KB

                            MD5

                            7cd73270bd735f9fe77bc9278f9f2b8b

                            SHA1

                            b27a898970297c750fb7e4d70ad8f87c1e6c1739

                            SHA256

                            ee80340a02c0f96a3f9d01e635857d38d7b92444d6102ee29804f559f2eaa7f4

                            SHA512

                            1fe70455d4d8c0fbab9ef20cf85d0de55fea9f18499c653af5d234462aa5c45eaacceadab39e9be62dc548af4f710362dd34970e1d8a666bf09fe4101bf32077

                          • C:\Users\Admin\AppData\Local\Temp\D79.exe
                            Filesize

                            332KB

                            MD5

                            e75ec445beb33e400201791a3fba433d

                            SHA1

                            a2c29449d05c2a26077e45dfcb45e37ef7c638a8

                            SHA256

                            f16953dfb98fb54bde6e9410883839e228ee09aa0a09892ab56a5ddfc76e7a0e

                            SHA512

                            4efdb748bcaef9aa1ca5bc934d5797f692a7bbd974fc675318124a4bfce62e074fd32a3033a10057a5af5cc1b9d2c7d87de316c31bce0f5b7d61983f1f967134

                          • C:\Users\Admin\AppData\Local\Temp\D79.exe
                            Filesize

                            332KB

                            MD5

                            e75ec445beb33e400201791a3fba433d

                            SHA1

                            a2c29449d05c2a26077e45dfcb45e37ef7c638a8

                            SHA256

                            f16953dfb98fb54bde6e9410883839e228ee09aa0a09892ab56a5ddfc76e7a0e

                            SHA512

                            4efdb748bcaef9aa1ca5bc934d5797f692a7bbd974fc675318124a4bfce62e074fd32a3033a10057a5af5cc1b9d2c7d87de316c31bce0f5b7d61983f1f967134

                          • C:\Users\Admin\AppData\Local\Temp\GBQHURCC-20220812-1921.log
                            Filesize

                            60KB

                            MD5

                            1cf46c46969b3da7c921f538e1052d75

                            SHA1

                            55b4f1bf8834de7fcec5b964d4e207ab787d453a

                            SHA256

                            8c1d6e5d024f1fa3f60323e3d7b2d76c4090f73aab9aca557b74edf58cb68a19

                            SHA512

                            78de5976109b5351e68c28069cd543e667a6361ca9fe7e5b141b1979f94ec46e26389d2e1e871cd8259890ade477f90f29ca4a091968333bd8a4fbd8d820b2fc

                          • C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20220812_191538705.html
                            Filesize

                            94KB

                            MD5

                            c37a4768436536ce937e2f4ae25bdee9

                            SHA1

                            d2ee32b61d348838b16b49005ffd112c77686970

                            SHA256

                            0be98a2f88b59cc8a14e48b604678303a0855a629751c2a31940a7b4073fa5a3

                            SHA512

                            2a9b95cb00e59a9365fd50589b68de9886e2b81a53ddee4032d25ff53024d3dd1b4620ae651cf665e639764e283db52987257eecb7525d2cdc44003e1a4f6f46

                          • C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmp
                            Filesize

                            3.3MB

                            MD5

                            13d0ff809f24a408728fd6fe00241020

                            SHA1

                            fde8484da982eceb86cf6959460ffc4ce33271a9

                            SHA256

                            db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520

                            SHA512

                            38dd1c523eb9f5aa1c3da0e95f4064f22fc191ce8cea20803c5f60fcbc40d83f5c3545529863ca18f4e65b3ea7a8eddc247ae0db11c6ffa70af560998611e768

                          • C:\Users\Admin\AppData\Local\Temp\adc52f94-c82e-434e-9f30-9b348375f053.tmp
                            Filesize

                            23KB

                            MD5

                            2e0a52964e4f43a9830f01775bcb061b

                            SHA1

                            deedc2124380dcc834798466b7ae8ca986aba82f

                            SHA256

                            3884df97009ac7e97143743660ed8e010d5f77edcf611bf85276e876fc70754b

                            SHA512

                            56c28175bfeb1adfa70761dbf3d46f60b3545de1dd879b346658a2701a173c5fd1959dcb6ecb931f7589f8178fa46d026da0edcfef0471f0fc9d65df7bc6ea44

                          • C:\Users\Admin\AppData\Local\Temp\aria-debug-4640.log
                            Filesize

                            470B

                            MD5

                            557f0a02b3501eb4e60e5fba315b99ee

                            SHA1

                            4f259e938512bda39d0701ee46d06823fa654e15

                            SHA256

                            13adbffe25952b222854ce31a71f71f5ffd885f91abcf912d3a9129be553a381

                            SHA512

                            def43befeed26be88a4997a649192cffabe428b58f99d0d833b74c40ab1e409bd2c42633d6f7acb83b8939413becb1e4f8d01291d4a9333c383c48a407f9e90f

                          • C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4F4B.txt
                            Filesize

                            11KB

                            MD5

                            b48fb4390143156503eaac1801906dc0

                            SHA1

                            3d656096d559e35fdb90569f6f5e151b041b7d09

                            SHA256

                            8cfe7d0b442bc501af66e76f6690929059f589e89d1eb8420c47b2ac40d4dd1c

                            SHA512

                            9323aeddf2b6aacc18aaee4c8eb75974499147e0860853f73e2ce183f7a804925649bac3fadf98e155990305569de6e9f3bac46ebca9540b8776ad7a3fa55701

                          • C:\Users\Admin\AppData\Local\Temp\jusched.log
                            Filesize

                            266KB

                            MD5

                            24082ee6914d520e5e6789a2ed2b9d19

                            SHA1

                            8d31261ffdc3c25521d1439a6a468f015c5e5207

                            SHA256

                            57a0b1d1e4992728c2d86b5122a7b505e8faefa435afbcb0606f76f01538fc55

                            SHA512

                            7c95e4aa202fe47c198954fd163f213d8589647bee4050cb3c800f537ece32fabee95074c70f919c5c35c84518dee89b25ab54248213ff4df692a03d58ea776f

                          • C:\Users\Admin\AppData\Local\Temp\wct1510.tmp
                            Filesize

                            62KB

                            MD5

                            7185e716980842db27c3b3a88e1fe804

                            SHA1

                            e4615379cd4797629b4cc3da157f4d4a5412fb2b

                            SHA256

                            094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1

                            SHA512

                            dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c

                          • C:\Users\Admin\AppData\Local\Temp\wct4E2A.tmp
                            Filesize

                            62KB

                            MD5

                            7185e716980842db27c3b3a88e1fe804

                            SHA1

                            e4615379cd4797629b4cc3da157f4d4a5412fb2b

                            SHA256

                            094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1

                            SHA512

                            dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c

                          • C:\Users\Admin\AppData\Local\Temp\wmsetup.log
                            Filesize

                            697B

                            MD5

                            bdcd60d0f8f1a5c5541b99599702de47

                            SHA1

                            e18d6ad9df2a91c55f90c725fb0a5885cef369bc

                            SHA256

                            c4975a51f52c7e43048be7ca33fca70869ad84845a489967ab7c93d4be28cf3c

                            SHA512

                            c98abf7754f78d171e18e5ca3ba8fb25f4793b02bc1f3f43ecf626c1c4f80f28f9ebec95b2ff4548235db7dbe4f15338623b3259ca73feade3bca6ff76bf3e76

                          • memory/1008-154-0x0000000000000000-mapping.dmp
                          • memory/1832-170-0x0000000000000000-mapping.dmp
                          • memory/1832-171-0x00000000030E0000-0x0000000003B92000-memory.dmp
                            Filesize

                            10.7MB

                          • memory/1832-172-0x0000000003DD0000-0x0000000003F10000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/1832-173-0x0000000003DD0000-0x0000000003F10000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/1832-187-0x00000000030E0000-0x0000000003B92000-memory.dmp
                            Filesize

                            10.7MB

                          • memory/1832-186-0x00000000030E0000-0x0000000003B92000-memory.dmp
                            Filesize

                            10.7MB

                          • memory/1832-185-0x0000000000C60000-0x00000000015F2000-memory.dmp
                            Filesize

                            9.6MB

                          • memory/2280-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
                            Filesize

                            36KB

                          • memory/2280-134-0x0000000000400000-0x0000000000594000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2280-135-0x0000000000400000-0x0000000000594000-memory.dmp
                            Filesize

                            1.6MB

                          • memory/2280-132-0x0000000000862000-0x0000000000872000-memory.dmp
                            Filesize

                            64KB

                          • memory/3336-153-0x0000000000000000-mapping.dmp
                          • memory/3464-144-0x0000000000000000-mapping.dmp
                          • memory/3464-156-0x0000000000400000-0x00000000005B1000-memory.dmp
                            Filesize

                            1.7MB

                          • memory/3464-155-0x0000000000853000-0x000000000087F000-memory.dmp
                            Filesize

                            176KB

                          • memory/3464-149-0x0000000000400000-0x00000000005B1000-memory.dmp
                            Filesize

                            1.7MB

                          • memory/3464-148-0x0000000000A40000-0x0000000000A89000-memory.dmp
                            Filesize

                            292KB

                          • memory/3464-147-0x0000000000853000-0x000000000087F000-memory.dmp
                            Filesize

                            176KB

                          • memory/3756-139-0x0000000000000000-mapping.dmp
                          • memory/3800-157-0x0000000000400000-0x0000000000DE1000-memory.dmp
                            Filesize

                            9.9MB

                          • memory/3800-169-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-168-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-167-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-166-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-140-0x0000000001296000-0x0000000001AD1000-memory.dmp
                            Filesize

                            8.2MB

                          • memory/3800-165-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-164-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-136-0x0000000000000000-mapping.dmp
                          • memory/3800-163-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-162-0x0000000005950000-0x0000000005A90000-memory.dmp
                            Filesize

                            1.2MB

                          • memory/3800-161-0x0000000004DA0000-0x0000000005852000-memory.dmp
                            Filesize

                            10.7MB

                          • memory/3800-160-0x0000000004DA0000-0x0000000005852000-memory.dmp
                            Filesize

                            10.7MB

                          • memory/3800-159-0x0000000004DA0000-0x0000000005852000-memory.dmp
                            Filesize

                            10.7MB

                          • memory/3800-158-0x0000000000400000-0x0000000000DE1000-memory.dmp
                            Filesize

                            9.9MB

                          • memory/3800-141-0x0000000003380000-0x0000000003D56000-memory.dmp
                            Filesize

                            9.8MB

                          • memory/3800-142-0x0000000000400000-0x0000000000DE1000-memory.dmp
                            Filesize

                            9.9MB

                          • memory/3800-143-0x0000000000400000-0x0000000000DE1000-memory.dmp
                            Filesize

                            9.9MB

                          • memory/3800-188-0x0000000000400000-0x0000000000DE1000-memory.dmp
                            Filesize

                            9.9MB

                          • memory/3800-189-0x0000000004DA0000-0x0000000005852000-memory.dmp
                            Filesize

                            10.7MB