stealc | 8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
Size

8.3MB
MD5

2780aa0eed2951601dc61d4c38011b85
SHA1

1e5b178f61f58a9e90b267d881c20031f530c001
SHA256

8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b
SHA512

f599fec839cb48c3c145e0ef8583949fff3b5538b8ad402bd4e06b6f851c7bb682f884757fa6dbaac3fce134c34cd86236abc76b7c657d4370cdcf4046c2f09e
SSDEEP

196608:exOxtJahKu0vlXzxh+ZD2G1md3dtonTkM:7xtJtzX2ZD2GUtonv

Score

10^/10

stealc vidar 8ec2721615c8de7e0afa1fdbfc111f76 discovery persistence stealer

Malware Config

Extracted

Family

vidar

Version

11.7

Botnet

8ec2721615c8de7e0afa1fdbfc111f76

https://t.me/m07mbk

https://steamcommunity.com/profiles/76561199801589826

Signatures

Detect Vidar Stealer 7 IoCs

stealer

resource	yara_rule
behavioral1/memory/2796-56-0x0000000000400000-0x000000000082E000-memory.dmp	family_vidar_v7
behavioral1/memory/2796-55-0x0000000000400000-0x000000000082E000-memory.dmp	family_vidar_v7
behavioral1/memory/2648-54-0x0000000000830000-0x0000000000A89000-memory.dmp	family_vidar_v7
behavioral1/memory/2648-58-0x0000000000830000-0x0000000000A89000-memory.dmp	family_vidar_v7
behavioral1/memory/2648-111-0x0000000000830000-0x0000000000A89000-memory.dmp	family_vidar_v7
behavioral1/memory/2648-112-0x0000000000830000-0x0000000000A89000-memory.dmp	family_vidar_v7
behavioral1/memory/2648-113-0x0000000000830000-0x0000000000A89000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Executes dropped EXE 3 IoCs

pid	Process
2796	BUILD.EXE
2904	CRYPTED.EXE
2648	BUILD.EXE

Loads dropped DLL 4 IoCs

pid	Process
2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
2796	BUILD.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\SafeUpdater = "C:\\Users\\Admin\\Videos\\MonetaUpdater\\UpdaterMoneta.exe"	BUILD.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BUILD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BUILD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BUILD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BUILD.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1752	timeout.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	BUILD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	BUILD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	BUILD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2648	BUILD.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2380 wrote to memory of 2508	2380	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	31
PID 2508 wrote to memory of 2796	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	32
PID 2508 wrote to memory of 2796	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	32
PID 2508 wrote to memory of 2796	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	32
PID 2508 wrote to memory of 2796	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	32
PID 2508 wrote to memory of 2796	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	32
PID 2508 wrote to memory of 2796	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	32
PID 2508 wrote to memory of 2796	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	32
PID 2508 wrote to memory of 2904	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	33
PID 2508 wrote to memory of 2904	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	33
PID 2508 wrote to memory of 2904	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	33
PID 2508 wrote to memory of 2904	2508	8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe	33
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2796 wrote to memory of 2648	2796	BUILD.EXE	35
PID 2648 wrote to memory of 1392	2648	BUILD.EXE	38
PID 2648 wrote to memory of 1392	2648	BUILD.EXE	38
PID 2648 wrote to memory of 1392	2648	BUILD.EXE	38
PID 2648 wrote to memory of 1392	2648	BUILD.EXE	38
PID 1392 wrote to memory of 1752	1392	cmd.exe	40
PID 1392 wrote to memory of 1752	1392	cmd.exe	40
PID 1392 wrote to memory of 1752	1392	cmd.exe	40
PID 1392 wrote to memory of 1752	1392	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
"C:\Users\Admin\AppData\Local\Temp\8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe
  "C:\Users\Admin\AppData\Local\Temp\8eae0fa62e0400bda4c1f395103d02390199045c35ece42d437a9d878433440b.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\BUILD.EXE
    "C:\Users\Admin\AppData\Local\Temp\BUILD.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\BUILD.EXE
      "C:\Users\Admin\AppData\Local\Temp\BUILD.EXE"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\BUILD.EXE" & rd /s /q "C:\ProgramData\ECGHCBGCBFHI" & exit
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1392
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1752
- - C:\Users\Admin\AppData\Local\Temp\CRYPTED.EXE
    "C:\Users\Admin\AppData\Local\Temp\CRYPTED.EXE"
    3⤵
    - Executes dropped EXE
    PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CRYPTED.EXE

Filesize
353KB

MD5
a6c522213b6d328513ac0770555035f4

SHA1
e3376ed412a343b6c787c7b5cf62ec63d47aa00c

SHA256
0a14b17aa3dfadac32fb1b5fffbe2f68f694f5a5b3adc3b9363458f329952238

SHA512
93723e343751815b406f0b7dbfd2fa9dda558e577a2e5852eb42d92c44685b643463faf691213025a1f19d1a2b5266245ffac5bd6e7f5a463f3ec000d0ae7dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8039.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar809A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\BUILD.EXE

Filesize
4.1MB

MD5
117231c0ea5644ae28ec0a8963b14e41

SHA1
4e28424ff04d51ec065e93f85a5e9e1b4ccc992d

SHA256
c5f355ea361d59345a90a6f1e157d29e982830d623202af7ecff5288d6f75c32

SHA512
5488f16020f1b14241e43c30640641fd0cead88a4f607e405b8ad42f31f161c4c38b58189111491c9901ac65a1cd2f7d43b43b9b75ce76eae4c35d48835dc988

Download Submit
memory/2380-26-0x0000000000C16000-0x0000000000C43000-memory.dmp

Filesize
180KB

Download
memory/2380-19-0x0000000000517000-0x000000000052F000-memory.dmp

Filesize
96KB

Download
memory/2380-25-0x0000000000C0E000-0x0000000000C43000-memory.dmp

Filesize
212KB

Download
memory/2380-24-0x0000000000C0A000-0x0000000000C0F000-memory.dmp

Filesize
20KB

Download
memory/2380-23-0x0000000000C04000-0x0000000000C0F000-memory.dmp

Filesize
44KB

Download
memory/2380-7-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2380-22-0x0000000000C01000-0x0000000000C05000-memory.dmp

Filesize
16KB

Download
memory/2380-21-0x0000000000C42000-0x0000000000C61000-memory.dmp

Filesize
124KB

Download
memory/2380-20-0x0000000000BFA000-0x0000000000C05000-memory.dmp

Filesize
44KB

Download
memory/2380-6-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2380-13-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2380-2-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2380-12-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2380-14-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2380-5-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2380-3-0x0000000000517000-0x000000000052F000-memory.dmp

Filesize
96KB

Download
memory/2380-0-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2508-8-0x0000000000C70000-0x00000000010FA000-memory.dmp

Filesize
4.5MB

Download
memory/2508-16-0x0000000000C70000-0x00000000010FA000-memory.dmp

Filesize
4.5MB

Download
memory/2508-41-0x0000000000C70000-0x00000000010FA000-memory.dmp

Filesize
4.5MB

Download
memory/2508-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-11-0x0000000000C70000-0x00000000010FA000-memory.dmp

Filesize
4.5MB

Download
memory/2508-27-0x0000000000400000-0x0000000000C61000-memory.dmp

Filesize
8.4MB

Download
memory/2648-51-0x0000000000830000-0x0000000000A89000-memory.dmp

Filesize
2.3MB

Download
memory/2648-113-0x0000000000830000-0x0000000000A89000-memory.dmp

Filesize
2.3MB

Download
memory/2648-112-0x0000000000830000-0x0000000000A89000-memory.dmp

Filesize
2.3MB

Download
memory/2648-111-0x0000000000830000-0x0000000000A89000-memory.dmp

Filesize
2.3MB

Download
memory/2648-54-0x0000000000830000-0x0000000000A89000-memory.dmp

Filesize
2.3MB

Download
memory/2648-58-0x0000000000830000-0x0000000000A89000-memory.dmp

Filesize
2.3MB

Download
memory/2796-56-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/2796-48-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/2796-55-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/2796-45-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/2796-46-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/2796-47-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download
memory/2796-43-0x0000000000400000-0x000000000082E000-memory.dmp

Filesize
4.2MB

Download