stealc | 12ca25e6461fd5a1178fdc0a4b23cfa88225dec174fbd48ff6587a50b24d5a38

Analysis

max time kernel
121s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

#)#NEw_SetUp_33778_P@$$Key#(#/New-Setup.exe
Size

316KB
MD5

c637e5ecf625b72f4bef9d28cd81d612
SHA1

a2c1329d290e508ee9fd0eb81e7f25d57e450f8c
SHA256

111c56593668be63e1e0c79a2d33d9e2d49cdf0c5100663c72045bc6b76e9fe6
SHA512

727d78bab4fab3674eec92ca5f07df6a0095ab3b973dd227c599c70e8493592bb53bb9208cc6270713283ef0065acfad3203ddcf4dcb6d43f8727f09ceaaf2e4
SSDEEP

6144:VzsRSKkhKKXDD2mTLGxelHJ+SBae3VFpSX:6VkhZWEGxelH0SBtfpS

Score

10^/10

stealc vidar discovery spyware stealer

Malware Config

Extracted

Family

stealc

rc4.plain

Signatures

Detect Vidar Stealer 7 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4744-22-0x0000000000800000-0x0000000000F4B000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-25-0x0000000000800000-0x0000000000F4B000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-28-0x0000000000800000-0x0000000000F4B000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-106-0x0000000000800000-0x0000000000F4B000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-148-0x0000000000800000-0x0000000000F4B000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-152-0x0000000000800000-0x0000000000F4B000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-159-0x0000000000800000-0x0000000000F4B000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

coml.au3

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation coml.au3
Executes dropped EXE 2 IoCs

Processes:

HCBAKJEHDB.exeFHIIEHJKKE.exe

pid process

1452 HCBAKJEHDB.exe
1860 FHIIEHJKKE.exe
Loads dropped DLL 3 IoCs

Processes:

coml.au3

pid process

4744 coml.au3
4744 coml.au3
4744 coml.au3
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	coml.au3

pid	process
1452	HCBAKJEHDB.exe
1860	FHIIEHJKKE.exe

pid	process
4744	coml.au3
4744	coml.au3
4744	coml.au3

Suspicious use of SetThreadContext 3 IoCs

Processes:

New-Setup.exeHCBAKJEHDB.exeFHIIEHJKKE.exe

description	pid	process	target process
PID 876 set thread context of 4616	876	New-Setup.exe	netsh.exe
PID 1452 set thread context of 4436	1452	HCBAKJEHDB.exe	ftp.exe
PID 1860 set thread context of 3140	1860	FHIIEHJKKE.exe	ftp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

coml.au3

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString coml.au3

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	coml.au3

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

coml.au3

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	coml.au3
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	coml.au3

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

New-Setup.exenetsh.execoml.au3HCBAKJEHDB.exeFHIIEHJKKE.exeftp.exeftp.exe

pid	process
876	New-Setup.exe
876	New-Setup.exe
4616	netsh.exe
4616	netsh.exe
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
4744	coml.au3
1452	HCBAKJEHDB.exe
1860	FHIIEHJKKE.exe
1452	HCBAKJEHDB.exe
1452	HCBAKJEHDB.exe
1860	FHIIEHJKKE.exe
1860	FHIIEHJKKE.exe
4436	ftp.exe
4436	ftp.exe
4436	ftp.exe
3140	ftp.exe
4436	ftp.exe
3140	ftp.exe
3140	ftp.exe
3140	ftp.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

New-Setup.exenetsh.exeHCBAKJEHDB.exeFHIIEHJKKE.exe

pid process

876 New-Setup.exe
4616 netsh.exe
1452 HCBAKJEHDB.exe
1860 FHIIEHJKKE.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

New-Setup.exenetsh.execoml.au3HCBAKJEHDB.exeFHIIEHJKKE.exe

description	pid	process	target process
PID 876 wrote to memory of 4616	876	New-Setup.exe	netsh.exe
PID 876 wrote to memory of 4616	876	New-Setup.exe	netsh.exe
PID 876 wrote to memory of 4616	876	New-Setup.exe	netsh.exe
PID 876 wrote to memory of 4616	876	New-Setup.exe	netsh.exe
PID 4616 wrote to memory of 4744	4616	netsh.exe	coml.au3
PID 4616 wrote to memory of 4744	4616	netsh.exe	coml.au3
PID 4616 wrote to memory of 4744	4616	netsh.exe	coml.au3
PID 4616 wrote to memory of 4744	4616	netsh.exe	coml.au3
PID 4616 wrote to memory of 4744	4616	netsh.exe	coml.au3
PID 4744 wrote to memory of 1452	4744	coml.au3	HCBAKJEHDB.exe
PID 4744 wrote to memory of 1452	4744	coml.au3	HCBAKJEHDB.exe
PID 4744 wrote to memory of 1452	4744	coml.au3	HCBAKJEHDB.exe
PID 4744 wrote to memory of 1860	4744	coml.au3	FHIIEHJKKE.exe
PID 4744 wrote to memory of 1860	4744	coml.au3	FHIIEHJKKE.exe
PID 4744 wrote to memory of 1860	4744	coml.au3	FHIIEHJKKE.exe
PID 1452 wrote to memory of 4436	1452	HCBAKJEHDB.exe	ftp.exe
PID 1452 wrote to memory of 4436	1452	HCBAKJEHDB.exe	ftp.exe
PID 1452 wrote to memory of 4436	1452	HCBAKJEHDB.exe	ftp.exe
PID 1860 wrote to memory of 3140	1860	FHIIEHJKKE.exe	ftp.exe
PID 1860 wrote to memory of 3140	1860	FHIIEHJKKE.exe	ftp.exe
PID 1860 wrote to memory of 3140	1860	FHIIEHJKKE.exe	ftp.exe
PID 1452 wrote to memory of 4436	1452	HCBAKJEHDB.exe	ftp.exe
PID 1860 wrote to memory of 3140	1860	FHIIEHJKKE.exe	ftp.exe

C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\#)#NEw_SetUp_33778_P@$$Key#(#\New-Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4616

C:\Users\Admin\AppData\Local\Temp\coml.au3
C:\Users\Admin\AppData\Local\Temp\coml.au3
3⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744

C:\ProgramData\HCBAKJEHDB.exe
"C:\ProgramData\HCBAKJEHDB.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\ftp.exe
C:\Windows\SysWOW64\ftp.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436

C:\ProgramData\FHIIEHJKKE.exe
"C:\ProgramData\FHIIEHJKKE.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\ftp.exe
C:\Windows\SysWOW64\ftp.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2936 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:3
1⤵
PID:4244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\FHIIEHJKKE.exe
Filesize
2.3MB

MD5
daaff76b0baf0a1f9cec253560c5db20

SHA1
0311cf0eeb4beddd2c69c6e97462595313a41e78

SHA256
5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c

SHA512
987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

Download Submit
C:\ProgramData\HCBAKJEHDB.exe
Filesize
8.6MB

MD5
6cfddd5ce9ca4bb209bd5d8c2cd80025

SHA1
424da82e9edbb6b39a979ab97d84239a1d67c48b

SHA256
376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7

SHA512
d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

Download Submit
C:\ProgramData\KKKJEHCGCGDA\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\KKKJEHCGCGDA\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Temp\2c6b338b
Filesize
6.8MB

MD5
b7969ead58c6a672c306235a4f365551

SHA1
e0e525edb2b13d94ed26e20eb1502fb6413a707f

SHA256
4adbb0ca0b817d3a41e0733d3345194d8574fca11d7b02c2ec5e773220c58a55

SHA512
eba0d47923d2720f7776cb1bdd6d867643b681070287d9979de4f2148169de01e04f82e634d5a0e5a51ef162de7af1d9f794259797b95e58965ed2dfe69ee00a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e992864
Filesize
1.1MB

MD5
8d443e7cb87cacf0f589ce55599e008f

SHA1
c7ff0475a3978271e0a8417ac4a826089c083772

SHA256
e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a

SHA512
c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5ee71ae2
Filesize
951KB

MD5
c62f812e250409fbd3c78141984270f2

SHA1
9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806

SHA256
d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8

SHA512
7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fbec822
Filesize
1.1MB

MD5
0993cd20420b0480234675d2dd0b7820

SHA1
4b2d957b2bdb0fc07b1bca6d71c6b7716838e9e7

SHA256
14f302cef8991541b43cfad7f1ec8f6065a6047599fbe4471abe49f86a0f0f50

SHA512
0ec9ed0f8e116b340d80c62d7527be07dec1d3deff912d2c1828fe96c74cebfdf7e1e80d9c48fdc989942e0785017c5437dc0b59b087c3c097a726edd27b3cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fc81af6
Filesize
736KB

MD5
eeb94f7078b8a4045fc0c5a3b9103acb

SHA1
d037aaccd96266f482815611f1c3322773d48ba9

SHA256
804a598d2cee70d9943b7e7007b25edd7db07319a1244b0dc2bb7ebd523d273f

SHA512
098d1cbeb6225d3eef66fadc36f6250db40bac827134b5ee83a4698d8c8755f9268b62c3958b7e998310a1265db5946d84ae1ee9a9677cfae4deba501f32fd5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\coml.au3
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/876-13-0x00007FFCE7F80000-0x00007FFCE80F2000-memory.dmp

Filesize
1.4MB

Download
memory/876-0-0x00007FFCE7F80000-0x00007FFCE80F2000-memory.dmp

Filesize
1.4MB

Download
memory/876-11-0x00007FFCE7F98000-0x00007FFCE7F99000-memory.dmp

Filesize
4KB

Download
memory/876-12-0x00007FFCE7F80000-0x00007FFCE80F2000-memory.dmp

Filesize
1.4MB

Download
memory/1452-122-0x0000000000150000-0x0000000000663000-memory.dmp

Filesize
5.1MB

Download
memory/1452-153-0x0000000072A30000-0x0000000072BAB000-memory.dmp

Filesize
1.5MB

Download
memory/1452-143-0x0000000072A30000-0x0000000072BAB000-memory.dmp

Filesize
1.5MB

Download
memory/1452-146-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp

Filesize
2.0MB

Download
memory/1860-155-0x0000000072A30000-0x0000000072BAB000-memory.dmp

Filesize
1.5MB

Download
memory/1860-137-0x0000000000AC0000-0x0000000000D08000-memory.dmp

Filesize
2.3MB

Download
memory/1860-145-0x0000000072A30000-0x0000000072BAB000-memory.dmp

Filesize
1.5MB

Download
memory/1860-147-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp

Filesize
2.0MB

Download
memory/3140-161-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp

Filesize
2.0MB

Download
memory/4436-160-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp

Filesize
2.0MB

Download
memory/4616-16-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp

Filesize
2.0MB

Download
memory/4744-25-0x0000000000800000-0x0000000000F4B000-memory.dmp

Filesize
7.3MB

Download
memory/4744-152-0x0000000000800000-0x0000000000F4B000-memory.dmp

Filesize
7.3MB

Download
memory/4744-148-0x0000000000800000-0x0000000000F4B000-memory.dmp

Filesize
7.3MB

Download
memory/4744-106-0x0000000000800000-0x0000000000F4B000-memory.dmp

Filesize
7.3MB

Download
memory/4744-29-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4744-28-0x0000000000800000-0x0000000000F4B000-memory.dmp

Filesize
7.3MB

Download
memory/4744-159-0x0000000000800000-0x0000000000F4B000-memory.dmp

Filesize
7.3MB

Download
memory/4744-24-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp

Filesize
2.0MB

Download
memory/4744-22-0x0000000000800000-0x0000000000F4B000-memory.dmp

Filesize
7.3MB

Download