Analysis

  • max time kernel
    129s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2023 04:13

General

  • Target

    file.exe

  • Size

    334KB

  • MD5

    7e2ce616a24646e61ad7952e8b7d0cba

  • SHA1

    d5c20db435ac5ffbbe55ad09b7bc65bc4621daf1

  • SHA256

    24437b48b37eb7bc4eb143ab09b851e82313c9bda2abe2ce18f56ca1f71c7339

  • SHA512

    4a9a6dedd7225226031db70c5d24bf450c5daeb60c4cce0e3c2dedc2041a79d9c743c968423be8a37b938ee19285ae9649962e8c2f89078fb2bf14753797ee68

  • SSDEEP

    6144:oZLPNu/cSLEVEWCNRJyHtQK/fu1d0RstmTb:SBu/pCEWI2tQKXu1Xt

Malware Config

Extracted

Family

vidar

Version

2.2

Botnet

237

C2

https://t.me/litlebey

https://steamcommunity.com/profiles/76561199472399815

Attributes
  • profile_id

    237

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4824
  • C:\Users\Admin\AppData\Local\Temp\CF4B.exe
    C:\Users\Admin\AppData\Local\Temp\CF4B.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      2⤵
      • Creates scheduled task(s)
      PID:3956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 1128
      2⤵
      • Program crash
      PID:2848
  • C:\Users\Admin\AppData\Local\Temp\D2E6.exe
    C:\Users\Admin\AppData\Local\Temp\D2E6.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    PID:3232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 1852
      2⤵
      • Program crash
      PID:5060
  • C:\Users\Admin\AppData\Local\Temp\D49C.exe
    C:\Users\Admin\AppData\Local\Temp\D49C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\Engine.exe
      C:\Users\Admin\AppData\Local\Temp\SETUP_10673\Engine.exe /TH_ID=_1100 /OriginExe="C:\Users\Admin\AppData\Local\Temp\D49C.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Windows\SysWOW64\CmD.exe
        C:\Windows\system32\CmD.exe /c cmd < 41
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1220
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell get-process avastui
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2624
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell get-process avgui
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2072
          • C:\Windows\SysWOW64\certutil.exe
            certutil -decode 7 7JkSB
            5⤵
              PID:2344
            • C:\Windows\SysWOW64\findstr.exe
              findstr /V /R "^McNZguVzMAVMcaKBMuiboIAzlxCLPYBWVnkTamWIVDZgkhwKXHhleSstUzPUDlEOZYQXuRpjpmBFIkiWaROiLdUriuYYJeyLYkgjvrDyn$" 7JkSB
              5⤵
                PID:4632
              • C:\Users\Admin\AppData\Local\Temp\zurk3hgf.jnl\10156\Private.exe.pif
                10156\\Private.exe.pif 10156\\D
                5⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1320
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  6⤵
                    PID:2188
                • C:\Windows\SysWOW64\PING.EXE
                  ping localhost -n 8
                  5⤵
                  • Runs ping.exe
                  PID:1056
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:1452
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
          1⤵
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies registry class
          PID:3544
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4384 -ip 4384
          1⤵
            PID:3976
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3232 -ip 3232
            1⤵
              PID:2456
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
              1⤵
              • Checks processor information in registry
              • Modifies registry class
              PID:1832
            • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
              C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
              1⤵
              • Executes dropped EXE
              PID:5000

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Virtualization/Sandbox Evasion

            1
            T1497

            Modify Registry

            1
            T1112

            Credential Access

            Credentials in Files

            3
            T1081

            Discovery

            Query Registry

            6
            T1012

            Virtualization/Sandbox Evasion

            1
            T1497

            System Information Discovery

            6
            T1082

            Peripheral Device Discovery

            1
            T1120

            Remote System Discovery

            1
            T1018

            Collection

            Data from Local System

            3
            T1005

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mozglue.dll
              Filesize

              133KB

              MD5

              8f73c08a9660691143661bf7332c3c27

              SHA1

              37fa65dd737c50fda710fdbde89e51374d0c204a

              SHA256

              3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

              SHA512

              0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

            • C:\ProgramData\nss3.dll
              Filesize

              1.2MB

              MD5

              bfac4e3c5908856ba17d41edcd455a51

              SHA1

              8eec7e888767aa9e4cca8ff246eb2aacb9170428

              SHA256

              e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

              SHA512

              2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Filesize

              1KB

              MD5

              def65711d78669d7f8e69313be4acf2e

              SHA1

              6522ebf1de09eeb981e270bd95114bc69a49cda6

              SHA256

              aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

              SHA512

              05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              18KB

              MD5

              bfce55f762e57699698b92831f7dadd5

              SHA1

              35e287510a98ff2c2fba4a3441f86f70afca58cc

              SHA256

              2ea148c57a1f39e47ee833e11babe537c382f994c6297b8acb7e04f98ced91ca

              SHA512

              0112eca689611b660b42af250219d728788d0628364c963312f41a7b7e648d44fbfb86ed42769d7501db42ebd2a26124c26ddac03195088c682126c7eae9f38f

            • C:\Users\Admin\AppData\Local\Temp\CF4B.exe
              Filesize

              408KB

              MD5

              261b1db94ccf4266128e2eb71a80fda4

              SHA1

              9d4cd03297f31eabe957f261dc7c3c6c268bd39f

              SHA256

              b0072463e78182e8d9721f91f889a62d9ce59a348fddc5196b6201a5fa68b259

              SHA512

              2dd25970561cf9e3d946acd891b601e6aa7e6563dde6c10ed5ac1a6486bbc1851cf3908b5bdee6c9b29633e51c90339209c50d97c0ea28b897bd6e7117b1ac7b

            • C:\Users\Admin\AppData\Local\Temp\CF4B.exe
              Filesize

              408KB

              MD5

              261b1db94ccf4266128e2eb71a80fda4

              SHA1

              9d4cd03297f31eabe957f261dc7c3c6c268bd39f

              SHA256

              b0072463e78182e8d9721f91f889a62d9ce59a348fddc5196b6201a5fa68b259

              SHA512

              2dd25970561cf9e3d946acd891b601e6aa7e6563dde6c10ed5ac1a6486bbc1851cf3908b5bdee6c9b29633e51c90339209c50d97c0ea28b897bd6e7117b1ac7b

            • C:\Users\Admin\AppData\Local\Temp\D2E6.exe
              Filesize

              1.6MB

              MD5

              9a7432c6e41b43262f87e70b15bfd706

              SHA1

              3f8664fcea0a2857d9b98e14dfef588b0d8a6a78

              SHA256

              66a4157601cecc7190f76be440e5684ed02bfbb62fd4fb3f6053ca60fdc1b0c5

              SHA512

              e4b496383837ae37629b4ef7b277f3e98af6b93826c7949b2ae92c856953e53102d661de9f22b012f8f80ae853d6712c63d779f12e5eeb29a85001018b884018

            • C:\Users\Admin\AppData\Local\Temp\D2E6.exe
              Filesize

              1.6MB

              MD5

              9a7432c6e41b43262f87e70b15bfd706

              SHA1

              3f8664fcea0a2857d9b98e14dfef588b0d8a6a78

              SHA256

              66a4157601cecc7190f76be440e5684ed02bfbb62fd4fb3f6053ca60fdc1b0c5

              SHA512

              e4b496383837ae37629b4ef7b277f3e98af6b93826c7949b2ae92c856953e53102d661de9f22b012f8f80ae853d6712c63d779f12e5eeb29a85001018b884018

            • C:\Users\Admin\AppData\Local\Temp\D49C.exe
              Filesize

              1.4MB

              MD5

              6ebbf34f864e586871c20257f1fc5cc7

              SHA1

              7bde4ae2a9dc4ed454143e2a316f542bcbec7641

              SHA256

              c8f0c1b3d504cfd9871bc16e7f577658b50e92c23f8d0c27217d3e54bd164e37

              SHA512

              eff393c95066739a2baa34d42439f5af66f11aeb2232fbb941b2eed61757dba467da6bff21e5bcc447af9164bcddc4abc741eeda1c7ce8fd1f769029f6ea7083

            • C:\Users\Admin\AppData\Local\Temp\D49C.exe
              Filesize

              1.4MB

              MD5

              6ebbf34f864e586871c20257f1fc5cc7

              SHA1

              7bde4ae2a9dc4ed454143e2a316f542bcbec7641

              SHA256

              c8f0c1b3d504cfd9871bc16e7f577658b50e92c23f8d0c27217d3e54bd164e37

              SHA512

              eff393c95066739a2baa34d42439f5af66f11aeb2232fbb941b2eed61757dba467da6bff21e5bcc447af9164bcddc4abc741eeda1c7ce8fd1f769029f6ea7083

            • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\00000#07
              Filesize

              1.1MB

              MD5

              919717eda81a74e13a2ec305f6dc8883

              SHA1

              b65f985e1fb682d48f65cca54ad6a668d193dcb6

              SHA256

              7ec4373bec922185925e85d5e715c0a2226367d888344777d868892f40358b30

              SHA512

              4958aef0b6e17ea7d7512a2f0a24ab1f4f97599200ed7af93c086040231455099227c72bf2db630225369c7cd2e72d519c61bd707918cf7810e5ee36265a9226

            • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\00001#41
              Filesize

              12KB

              MD5

              0540a065f37ee25e30c5454f7f460a1e

              SHA1

              39fd5f9abc0db7ae1deceade63872e2429a3722b

              SHA256

              e2b69a4a51d11c37d4148672d9dbe5ee4f14d79d2a666df52eece3259517edf9

              SHA512

              0a98ef3552d6920f623040038fdfa92a020161efb0aa0f2c656643913ad8c124f5eb94db5e4dc9d32a82662ffb543e78625379e3261c544cd853c9a80f4518cc

            • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\00002#7
              Filesize

              1.2MB

              MD5

              7fef6abfe01fb4d7b7d1a61372cd694f

              SHA1

              30f99885134c106dda379fe2b1702bcde013cd90

              SHA256

              784977f5684e167b23ffcdf597d59a90151b7fc0e45fd8044fcdf4d3c36a793a

              SHA512

              414e0a79f7134cbaeb4c83cff6501dea5a7f4a4ce35f35db16509ae455d0d66916c96d3708d453047c322aaa5b5bdc18ad1df9a58cd17861ab20323ec12e39dc

            • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\Engine.exe
              Filesize

              392KB

              MD5

              debfb007af59891f08aaa75bff0e0df0

              SHA1

              cb00e41eeb60bc27cd32aad7adfc347a2b0e8f87

              SHA256

              e5a077d2a393e938f9cd7a2529f8b71a81f15406c2f19b878eb4ffdb15d483c7

              SHA512

              1bb3effddb47b30b9d7780cc05cb26061c8f6362c808bbca78a24833ca1884d4c2072eda6a5213a51458f2e0b9036f204a4f50ea771ba6294ac9c051b28832c1

            • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\Engine.exe
              Filesize

              392KB

              MD5

              debfb007af59891f08aaa75bff0e0df0

              SHA1

              cb00e41eeb60bc27cd32aad7adfc347a2b0e8f87

              SHA256

              e5a077d2a393e938f9cd7a2529f8b71a81f15406c2f19b878eb4ffdb15d483c7

              SHA512

              1bb3effddb47b30b9d7780cc05cb26061c8f6362c808bbca78a24833ca1884d4c2072eda6a5213a51458f2e0b9036f204a4f50ea771ba6294ac9c051b28832c1

            • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\Modern_Icon.bmp
              Filesize

              7KB

              MD5

              1dd88f67f029710d5c5858a6293a93f1

              SHA1

              3e5ef66613415fe9467b2a24ccc27d8f997e7df6

              SHA256

              b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532

              SHA512

              7071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94

            • C:\Users\Admin\AppData\Local\Temp\SETUP_10673\Setup.txt
              Filesize

              2KB

              MD5

              cffd985ca2a8a08a469bf77ad506b88d

              SHA1

              acfba7a321d39cfc6a6697cfcbc9383539041f3f

              SHA256

              f3b37b72e7a23854902c55afba7790bbfd50e99e8e13153f53546965905a94b5

              SHA512

              0a8b929a7666165e1cbde2011e4d89ad4ca906f4272eaf647b51c69baedc75609dbd9897032e8d13b929e09d76700aa32da38842fecda698faec09dc1ee2bdef

            • C:\Users\Admin\AppData\Local\Temp\zurk3hgf.jnl\10156\Private.exe.pif
              Filesize

              872KB

              MD5

              c56b5f0201a3b3de53e561fe76912bfd

              SHA1

              2a4062e10a5de813f5688221dbeb3f3ff33eb417

              SHA256

              237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

              SHA512

              195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

            • C:\Users\Admin\AppData\Local\Temp\zurk3hgf.jnl\10156\Private.exe.pif
              Filesize

              872KB

              MD5

              c56b5f0201a3b3de53e561fe76912bfd

              SHA1

              2a4062e10a5de813f5688221dbeb3f3ff33eb417

              SHA256

              237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

              SHA512

              195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

            • C:\Users\Admin\AppData\Local\Temp\zurk3hgf.jnl\7JkSB
              Filesize

              872KB

              MD5

              35953e969ce821054b4f14e39926142b

              SHA1

              10e895908a7b6d5a628668bffc64d0846baedd4e

              SHA256

              a9f2e558be6d344085173f1440b8fa2f6c2273680a51bbcf3d167bea3036b365

              SHA512

              cfd09ee2b40f3889069c2b533830bc2a46e3ec9b36033d9dd450065f1868fb24e7056f4e00992d896d19ca5d7922339e36106a8c7f11005cf7584aadb47846d7

            • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
              Filesize

              730.6MB

              MD5

              bf24110a617b875ebfd716445431f015

              SHA1

              7ce6c40f7ebc1d446c8a1272dee3cc71af7c2f62

              SHA256

              946ad9541eaa8501ba4f0d6a8264febb0d0deec5e5e45aad089103e63b033f9a

              SHA512

              3cec4f2822725183182772ff3e1501750885d7075e5d963878b136d30062a3609456d68fb2ee2a2f9c2dd7bf0da8cad19164af33823af8644ef36b7db97026bd

            • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
              Filesize

              731.7MB

              MD5

              d0d738f377a538853e57db44955d0375

              SHA1

              176ca8cf4fb624b87635afb40f52abd550fc3874

              SHA256

              b3fdc7e4b7923b554863a880b273b11c712bf59f4987d848199f4cd8b59e04e0

              SHA512

              0298ebb98ee752852ff3454f5ee6f6d970fc7f893f7c086ce817cd9d462cf1c0ea9f7d7949c902b6a897728add31f1b6cfaede7d42adac062fc4bea88f57cefe

            • memory/1056-219-0x0000000000000000-mapping.dmp
            • memory/1220-170-0x0000000000000000-mapping.dmp
            • memory/1320-217-0x0000000000000000-mapping.dmp
            • memory/2072-208-0x0000000000000000-mapping.dmp
            • memory/2328-169-0x0000000000000000-mapping.dmp
            • memory/2344-213-0x0000000000000000-mapping.dmp
            • memory/2368-164-0x0000000000400000-0x0000000000558000-memory.dmp
              Filesize

              1.3MB

            • memory/2368-157-0x0000000000000000-mapping.dmp
            • memory/2368-221-0x0000000000400000-0x0000000000558000-memory.dmp
              Filesize

              1.3MB

            • memory/2368-214-0x0000000000400000-0x0000000000558000-memory.dmp
              Filesize

              1.3MB

            • memory/2624-206-0x00000000062C0000-0x00000000062E2000-memory.dmp
              Filesize

              136KB

            • memory/2624-175-0x0000000004DC0000-0x0000000004DE2000-memory.dmp
              Filesize

              136KB

            • memory/2624-207-0x00000000072F0000-0x0000000007894000-memory.dmp
              Filesize

              5.6MB

            • memory/2624-205-0x0000000006270000-0x000000000628A000-memory.dmp
              Filesize

              104KB

            • memory/2624-204-0x00000000062F0000-0x0000000006386000-memory.dmp
              Filesize

              600KB

            • memory/2624-197-0x0000000005D60000-0x0000000005D7E000-memory.dmp
              Filesize

              120KB

            • memory/2624-179-0x0000000005700000-0x0000000005766000-memory.dmp
              Filesize

              408KB

            • memory/2624-178-0x0000000005690000-0x00000000056F6000-memory.dmp
              Filesize

              408KB

            • memory/2624-172-0x0000000000000000-mapping.dmp
            • memory/2624-173-0x00000000047A0000-0x00000000047D6000-memory.dmp
              Filesize

              216KB

            • memory/2624-174-0x0000000004E30000-0x0000000005458000-memory.dmp
              Filesize

              6.2MB

            • memory/3232-203-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-148-0x0000000077730000-0x00000000778D3000-memory.dmp
              Filesize

              1.6MB

            • memory/3232-139-0x0000000000000000-mapping.dmp
            • memory/3232-145-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-154-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-180-0x0000000077730000-0x00000000778D3000-memory.dmp
              Filesize

              1.6MB

            • memory/3232-181-0x0000000060900000-0x0000000060992000-memory.dmp
              Filesize

              584KB

            • memory/3232-155-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-153-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-152-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-147-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-156-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-149-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-146-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-212-0x0000000077730000-0x00000000778D3000-memory.dmp
              Filesize

              1.6MB

            • memory/3232-151-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-150-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3232-211-0x0000000000710000-0x0000000000B99000-memory.dmp
              Filesize

              4.5MB

            • memory/3892-142-0x0000000000000000-mapping.dmp
            • memory/3956-171-0x0000000000000000-mapping.dmp
            • memory/4384-177-0x0000000000400000-0x000000000046D000-memory.dmp
              Filesize

              436KB

            • memory/4384-161-0x00000000004CD000-0x00000000004F7000-memory.dmp
              Filesize

              168KB

            • memory/4384-163-0x0000000000400000-0x000000000046D000-memory.dmp
              Filesize

              436KB

            • memory/4384-176-0x00000000004CD000-0x00000000004F7000-memory.dmp
              Filesize

              168KB

            • memory/4384-162-0x0000000002060000-0x00000000020A7000-memory.dmp
              Filesize

              284KB

            • memory/4384-136-0x0000000000000000-mapping.dmp
            • memory/4632-215-0x0000000000000000-mapping.dmp
            • memory/4824-132-0x00000000004FD000-0x0000000000512000-memory.dmp
              Filesize

              84KB

            • memory/4824-135-0x0000000000400000-0x000000000045B000-memory.dmp
              Filesize

              364KB

            • memory/4824-134-0x0000000000400000-0x000000000045B000-memory.dmp
              Filesize

              364KB

            • memory/4824-133-0x0000000002190000-0x0000000002199000-memory.dmp
              Filesize

              36KB

            • memory/5000-224-0x000000000074C000-0x0000000000776000-memory.dmp
              Filesize

              168KB

            • memory/5000-225-0x0000000000400000-0x000000000046D000-memory.dmp
              Filesize

              436KB