vidar | b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b

Analysis

max time kernel
148s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2023 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2192209d6892b9bf8e6d155a53b69a5.exe
Size

3.3MB
MD5

d2192209d6892b9bf8e6d155a53b69a5
SHA1

f417394441a253f7f0ef661b00905fa51c71b4fc
SHA256

b644ed105b1208ac7d25de367523aec04f53c18c68d7e389d892a0930cba860b
SHA512

6cbe6898897864cd99579f000806867724c65327125250bb382204e012d375c9211acdac3cdfa36091daee42b0a1394777f69a51ad192ad9dabc7449af4c903f
SSDEEP

49152:B9fBVAeoycp8DtPCrZPKh0wCqMEvhuwteJoltx6I+PGnGToq5aOCDDHV3:BnVAeh+8Dtqtyh5Iw4qZoGnZOCfHl

Score

10^/10

vidar https://t.me/sundayevent evasion spyware stealer themida trojan

Malware Config

Extracted

Family

vidar

Version

4.8

Botnet

https://t.me/sundayevent

https://steamcommunity.com/profiles/76561198982268531

Attributes

profile_id_v2
https://t.me/sundayevent
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d2192209d6892b9bf8e6d155a53b69a5.exe
Downloads MZ/PE file

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d2192209d6892b9bf8e6d155a53b69a5.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d2192209d6892b9bf8e6d155a53b69a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d2192209d6892b9bf8e6d155a53b69a5.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

93052200695623275709.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	93052200695623275709.exe

Executes dropped EXE 3 IoCs

Processes:

08737593706120159719.exe93052200695623275709.exeDotNetServer.exe

pid process

2856 08737593706120159719.exe
2576 93052200695623275709.exe
4992 DotNetServer.exe
Loads dropped DLL 2 IoCs

Processes:

AppLaunch.exe

pid process

2160 AppLaunch.exe
2160 AppLaunch.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2856	08737593706120159719.exe
2576	93052200695623275709.exe
4992	DotNetServer.exe

pid	process
2160	AppLaunch.exe
2160	AppLaunch.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/2468-141-0x0000000000680000-0x0000000000D68000-memory.dmp	themida
behavioral2/memory/2468-178-0x0000000000680000-0x0000000000D68000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d2192209d6892b9bf8e6d155a53b69a5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exe

pid process

2468 d2192209d6892b9bf8e6d155a53b69a5.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exe

description pid process target process

PID 2468 set thread context of 2160 2468 d2192209d6892b9bf8e6d155a53b69a5.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2468 set thread context of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1192 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3792 timeout.exe

pid	process
1192	schtasks.exe

pid	process
3792	timeout.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exeAppLaunch.exe93052200695623275709.exeDotNetServer.exe

pid	process
2468	d2192209d6892b9bf8e6d155a53b69a5.exe
2468	d2192209d6892b9bf8e6d155a53b69a5.exe
2160	AppLaunch.exe
2160	AppLaunch.exe
2160	AppLaunch.exe
2160	AppLaunch.exe
2160	AppLaunch.exe
2160	AppLaunch.exe
2576	93052200695623275709.exe
2576	93052200695623275709.exe
4992	DotNetServer.exe
4992	DotNetServer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exe

description pid process

Token: SeDebugPrivilege 2468 d2192209d6892b9bf8e6d155a53b69a5.exe

description	pid	process
Token: SeDebugPrivilege	2468	d2192209d6892b9bf8e6d155a53b69a5.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

d2192209d6892b9bf8e6d155a53b69a5.exeAppLaunch.exe08737593706120159719.execmd.exe93052200695623275709.exe

description	pid	process	target process
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2468 wrote to memory of 2160	2468	d2192209d6892b9bf8e6d155a53b69a5.exe	AppLaunch.exe
PID 2160 wrote to memory of 2856	2160	AppLaunch.exe	08737593706120159719.exe
PID 2160 wrote to memory of 2856	2160	AppLaunch.exe	08737593706120159719.exe
PID 2856 wrote to memory of 3560	2856	08737593706120159719.exe	cmd.exe
PID 2856 wrote to memory of 3560	2856	08737593706120159719.exe	cmd.exe
PID 3560 wrote to memory of 4748	3560	cmd.exe	choice.exe
PID 3560 wrote to memory of 4748	3560	cmd.exe	choice.exe
PID 2160 wrote to memory of 2576	2160	AppLaunch.exe	93052200695623275709.exe
PID 2160 wrote to memory of 2576	2160	AppLaunch.exe	93052200695623275709.exe
PID 2160 wrote to memory of 2576	2160	AppLaunch.exe	93052200695623275709.exe
PID 2160 wrote to memory of 4332	2160	AppLaunch.exe	cmd.exe
PID 2160 wrote to memory of 4332	2160	AppLaunch.exe	cmd.exe
PID 2160 wrote to memory of 4332	2160	AppLaunch.exe	cmd.exe
PID 2576 wrote to memory of 1192	2576	93052200695623275709.exe	schtasks.exe
PID 2576 wrote to memory of 1192	2576	93052200695623275709.exe	schtasks.exe
PID 2576 wrote to memory of 1192	2576	93052200695623275709.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\d2192209d6892b9bf8e6d155a53b69a5.exe
"C:\Users\Admin\AppData\Local\Temp\d2192209d6892b9bf8e6d155a53b69a5.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160

C:\ProgramData\08737593706120159719.exe
"C:\ProgramData\08737593706120159719.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\08737593706120159719.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
5⤵
PID:4748

C:\ProgramData\93052200695623275709.exe
"C:\ProgramData\93052200695623275709.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /CREATE /TN "DotNetStartup" /TR "C:\ProgramData\DotNetSecurity\DotNetServer.exe" /SC MINUTE /RL HIGHEST
4⤵
- Creates scheduled task(s)
PID:1192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit
3⤵
PID:4332

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:3792

C:\ProgramData\DotNetSecurity\DotNetServer.exe
C:\ProgramData\DotNetSecurity\DotNetServer.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\08737593706120159719.exe

Filesize
13.9MB

MD5
93a4e8e9adf632c0d8a16f4b47418803

SHA1
24be78227a11ecfbd14c84f8881cc4d26422bfe9

SHA256
ecef465a5a60acb69ea5e4017dfe44d441d0127ef958686af8ccca48eae0e135

SHA512
7f6d41cf73bbbecb312ea85e06ab56bc9d54fcbb58ef3a68e0c16600284d6e810e029ef6f17970cd3732bcef5bd88566d808d407c54bd874df3f6092b6c1a620

Download Submit
C:\ProgramData\08737593706120159719.exe

Filesize
13.9MB

MD5
93a4e8e9adf632c0d8a16f4b47418803

SHA1
24be78227a11ecfbd14c84f8881cc4d26422bfe9

SHA256
ecef465a5a60acb69ea5e4017dfe44d441d0127ef958686af8ccca48eae0e135

SHA512
7f6d41cf73bbbecb312ea85e06ab56bc9d54fcbb58ef3a68e0c16600284d6e810e029ef6f17970cd3732bcef5bd88566d808d407c54bd874df3f6092b6c1a620

Download Submit
C:\ProgramData\08737593706120159719.exe

Filesize
13.9MB

MD5
93a4e8e9adf632c0d8a16f4b47418803

SHA1
24be78227a11ecfbd14c84f8881cc4d26422bfe9

SHA256
ecef465a5a60acb69ea5e4017dfe44d441d0127ef958686af8ccca48eae0e135

SHA512
7f6d41cf73bbbecb312ea85e06ab56bc9d54fcbb58ef3a68e0c16600284d6e810e029ef6f17970cd3732bcef5bd88566d808d407c54bd874df3f6092b6c1a620

Download Submit
C:\ProgramData\93052200695623275709.exe

Filesize
4.4MB

MD5
45c13576b9eadde3d24494a318fd794f

SHA1
d14f9ff23e7b100035ddb35ea321b3d06819d530

SHA256
d49592ffea94e11063c973edc95b95e8ce38c592627fe6de6bfd73062b8d3438

SHA512
714e46fb431fb0a94a2d307dad8a02e24205c1b3dc74225ed6cb296732e2c657ef4d7fa319a8071c8d0635d8851301df14889ebc5ea4ef3329f7fa523eaa9a3c

Download Submit
C:\ProgramData\93052200695623275709.exe

Filesize
4.4MB

MD5
45c13576b9eadde3d24494a318fd794f

SHA1
d14f9ff23e7b100035ddb35ea321b3d06819d530

SHA256
d49592ffea94e11063c973edc95b95e8ce38c592627fe6de6bfd73062b8d3438

SHA512
714e46fb431fb0a94a2d307dad8a02e24205c1b3dc74225ed6cb296732e2c657ef4d7fa319a8071c8d0635d8851301df14889ebc5ea4ef3329f7fa523eaa9a3c

Download Submit
C:\ProgramData\93052200695623275709.exe

Filesize
4.4MB

MD5
45c13576b9eadde3d24494a318fd794f

SHA1
d14f9ff23e7b100035ddb35ea321b3d06819d530

SHA256
d49592ffea94e11063c973edc95b95e8ce38c592627fe6de6bfd73062b8d3438

SHA512
714e46fb431fb0a94a2d307dad8a02e24205c1b3dc74225ed6cb296732e2c657ef4d7fa319a8071c8d0635d8851301df14889ebc5ea4ef3329f7fa523eaa9a3c

Download Submit
C:\ProgramData\DotNetSecurity\DotNetServer.exe

Filesize
4.4MB

MD5
45c13576b9eadde3d24494a318fd794f

SHA1
d14f9ff23e7b100035ddb35ea321b3d06819d530

SHA256
d49592ffea94e11063c973edc95b95e8ce38c592627fe6de6bfd73062b8d3438

SHA512
714e46fb431fb0a94a2d307dad8a02e24205c1b3dc74225ed6cb296732e2c657ef4d7fa319a8071c8d0635d8851301df14889ebc5ea4ef3329f7fa523eaa9a3c

Download Submit
C:\ProgramData\DotNetSecurity\DotNetServer.exe

Filesize
4.4MB

MD5
45c13576b9eadde3d24494a318fd794f

SHA1
d14f9ff23e7b100035ddb35ea321b3d06819d530

SHA256
d49592ffea94e11063c973edc95b95e8ce38c592627fe6de6bfd73062b8d3438

SHA512
714e46fb431fb0a94a2d307dad8a02e24205c1b3dc74225ed6cb296732e2c657ef4d7fa319a8071c8d0635d8851301df14889ebc5ea4ef3329f7fa523eaa9a3c

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
2KB

MD5
821b74d0821c3d74d934d745729065cc

SHA1
2ea18af05455007e570de08394b382cf27645a8c

SHA256
2fbd6ff44976b4a64fb5a01c243454c12dc2ab524f0458da96b2129f4ccefc86

SHA512
ff8e728d93780c628c35d3e99fcebe08c3ea8467e37eda831112bf7e127faa958bdc32a5ea666b9827bb228e61da19fcb0e523ba68409bb536bf86bf2443573e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30

Filesize
2KB

MD5
5967e6fbffab15852e26a4747f057e25

SHA1
84f39d1b2d57d43ae3d4586947f70dd88721d292

SHA256
7a4d15d9ca5263efaaf91e1a12f4a1d10a23462332cd46ba283776a6bccf093e

SHA512
11007ed73dfe2d7937d725d3e9d63c203b420c90c78096d544eecc9f61bede96561ff223c7100ed7b59c95cef8e6f4660387c2ee3a3a348fb3cea9c69f12c985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
8fcc0ee2a853975610257b1ab69985ac

SHA1
ca5d10a3f6819e123041c495cd8103e77500ac80

SHA256
aa3e09e14fb63de05b085df239e594c98481cb012e3d0a1b11297ef23536700c

SHA512
8ba583547adb97bfdf61a410a6268548658e7029b56194534511db9f780da8054e2b8273096df86c28803fd69f5e5ed1907a903082d3bc1662bbb17d36fc0c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
6ea0d2dce3291d7b45fe4323e2a52add

SHA1
40a0646c5e86fff1b858b18c6f89ad0c479e49fe

SHA256
e0c5076d2c06405e297b556fdd73484f27d72842bc4706e55cd84f18cbdafe46

SHA512
6fed9037259f3b0c6dd097ea9d847449f578310bbf023766b3f32292eed79ec65cd2b8a49029a37355c84b7c3dc0602b0f53e69dc65ea409f374a90bd4132a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30

Filesize
474B

MD5
7fa05716ac41e8a179a687a89caddc24

SHA1
55d58afe870ae5d8ea051c8f2c1c1d5562dff4e9

SHA256
064f43ee61c99e06512d7ef5ba6d50e1cba7e4c74e9d434c2bba87560ce699ce

SHA512
7243e0d10b314a1f78b16df950a3770fe419dcd1a0e630e932bdb0a269ce1e5050957b9d3b46a1f53afcf1eb286ebfd4b0f2ed9c6bdecc76a7a4ee80d16f3d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
7831d017e0d3598ff06a9780026fade6

SHA1
4579275f76be5fab46d13e0d226522cc7437ea76

SHA256
8624014b2a88518366eda87724b78568104bdba0f2ab41f505b2d58cfd8542c2

SHA512
6ec697bd4333360a14299aacac334e28fe493778565b9c9a9b0465f3ce6f34e0d7fad5606aa2a5a4affea693b42dd06eec496ffec0737ed86b09ae9565fc3031

Download Submit
memory/2160-256-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2160-257-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2160-278-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2160-173-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2160-281-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2160-189-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2160-177-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2160-174-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2160-172-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2468-155-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-147-0x0000000076CE0000-0x0000000076DD0000-memory.dmp

Filesize
960KB

Download
memory/2468-169-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-178-0x0000000000680000-0x0000000000D68000-memory.dmp

Filesize
6.9MB

Download
memory/2468-179-0x0000000076CE0000-0x0000000076DD0000-memory.dmp

Filesize
960KB

Download
memory/2468-167-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-165-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-163-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-161-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-159-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-157-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-133-0x0000000000680000-0x0000000000D68000-memory.dmp

Filesize
6.9MB

Download
memory/2468-153-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-134-0x0000000076CE0000-0x0000000076DD0000-memory.dmp

Filesize
960KB

Download
memory/2468-151-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-148-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-149-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-171-0x0000000003380000-0x0000000003395000-memory.dmp

Filesize
84KB

Download
memory/2468-146-0x0000000076CE0000-0x0000000076DD0000-memory.dmp

Filesize
960KB

Download
memory/2468-135-0x0000000076CE0000-0x0000000076DD0000-memory.dmp

Filesize
960KB

Download
memory/2468-136-0x0000000076CE0000-0x0000000076DD0000-memory.dmp

Filesize
960KB

Download
memory/2468-137-0x0000000077A84000-0x0000000077A86000-memory.dmp

Filesize
8KB

Download
memory/2468-141-0x0000000000680000-0x0000000000D68000-memory.dmp

Filesize
6.9MB

Download
memory/2468-145-0x0000000076CE0000-0x0000000076DD0000-memory.dmp

Filesize
960KB

Download
memory/2468-143-0x0000000000680000-0x0000000000D68000-memory.dmp

Filesize
6.9MB

Download
memory/2468-142-0x00000000056F0000-0x000000000578C000-memory.dmp

Filesize
624KB

Download
memory/2576-294-0x0000000000400000-0x0000000000B0E000-memory.dmp

Filesize
7.1MB

Download
memory/2576-284-0x0000000000400000-0x0000000000B0E000-memory.dmp

Filesize
7.1MB

Download
memory/2576-282-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/2576-280-0x0000000000400000-0x0000000000B0E000-memory.dmp

Filesize
7.1MB

Download
memory/2856-268-0x0000000000360000-0x00000000011AD000-memory.dmp

Filesize
14.3MB

Download
memory/4992-298-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/4992-300-0x0000000000400000-0x0000000000B0E000-memory.dmp

Filesize
7.1MB

Download
memory/4992-297-0x0000000000400000-0x0000000000B0E000-memory.dmp

Filesize
7.1MB

Download
memory/4992-309-0x0000000000400000-0x0000000000B0E000-memory.dmp

Filesize
7.1MB

Download
memory/4992-310-0x0000000000400000-0x0000000000B0E000-memory.dmp

Filesize
7.1MB

Download