vidar | 9a97197ab32aa3645c3c6e2862aec79d04c7aec015e33ab7589df6c9001f61a0

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HEU_KMS_Activator_30.4.0.exe
Size

7.5MB
MD5

fa8414423461fbc180cd6bb1ddce0943
SHA1

e47d1c1bbf202bcbfc887801833ebb6ba28b03ed
SHA256

9a97197ab32aa3645c3c6e2862aec79d04c7aec015e33ab7589df6c9001f61a0
SHA512

d62af6118880cc457b21b1749fcdde5353bd761993aaa84822897732be219fb229680ca6402338fde5f4436778aa68d24a88da120fce95ac109112273ab58a1f
SSDEEP

196608:NvGacofn0nk/6RGU+cu6xYDcUT+GXGMVPNBvLDA:Nveof0nid5cu6mDhyirTA

Score

10^/10

vidar 7e6c13833126d03adc9573b3325d5542 credential_access discovery spyware stealer upx

Malware Config

Extracted

Family

vidar

Version

Botnet

7e6c13833126d03adc9573b3325d5542

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/files/0x000a00000002353e-770.dat	family_vidar_v7
behavioral2/memory/3372-773-0x0000000000440000-0x00000000006B6000-memory.dmp	family_vidar_v7
behavioral2/memory/3372-907-0x0000000000440000-0x00000000006B6000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WindowsServices.exe

Executes dropped EXE 3 IoCs

pid	Process
3532	Patch.exe
5280	HEU_KMS_Activator_30.4.0.exe
3372	WindowsServices.exe

Loads dropped DLL 11 IoCs

pid	Process
640	HEU_KMS_Activator_30.4.0.exe
640	HEU_KMS_Activator_30.4.0.exe
3792	MsiExec.exe
4244	MsiExec.exe
4244	MsiExec.exe
4244	MsiExec.exe
4244	MsiExec.exe
4244	MsiExec.exe
640	HEU_KMS_Activator_30.4.0.exe
3372	WindowsServices.exe
3372	WindowsServices.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\K:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\M:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\W:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\S:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\O:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\Y:	HEU_KMS_Activator_30.4.0.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5280-757-0x0000000000A20000-0x0000000001345000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3532 set thread context of 5372	3532	Patch.exe	103

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023563-58.dat	upx
behavioral2/memory/5280-745-0x0000000000A20000-0x0000000001345000-memory.dmp	upx
behavioral2/memory/5280-757-0x0000000000A20000-0x0000000001345000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0.exe	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1CC7FD43-1DFB-4008-BBA4-B50E90B07479}	msiexec.exe
File created	C:\Windows\Installer\e5892e8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI949E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9333.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9400.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI943F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI974E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{1CC7FD43-1DFB-4008-BBA4-B50E90B07479}\HEU_KMS_Activator_30.4.0.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e5892e4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93C0.tmp	msiexec.exe
File created	C:\Windows\Installer\{1CC7FD43-1DFB-4008-BBA4-B50E90B07479}\HEU_KMS_Activator_30.4.0.exe	msiexec.exe
File created	C:\Windows\Installer\e5892e4.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	HEU_KMS_Activator_30.4.0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	HEU_KMS_Activator_30.4.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEU_KMS_Activator_30.4.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEU_KMS_Activator_30.4.0.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f7b83aff83bcb26e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f7b83aff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f7b83aff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df7b83aff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f7b83aff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WindowsServices.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WindowsServices.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5588	timeout.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\130422FEBEBB80448A4DC6D81128AFDF\34DF7CC1BFD18004BB4A5BE0090B4797	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList\PackageName = "HEU_KMS_Activator_30.4.0.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\PackageCode = "FA2EECDC30B9B5B44904E4F60008AD1A"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\ProductIcon = "C:\\Windows\\Installer\\{1CC7FD43-1DFB-4008-BBA4-B50E90B07479}\\HEU_KMS_Activator_30.4.0.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\130422FEBEBB80448A4DC6D81128AFDF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34DF7CC1BFD18004BB4A5BE0090B4797	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34DF7CC1BFD18004BB4A5BE0090B4797\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\ProductName = "HEU_KMS_Activator_30.4.0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\HEU_KMS_Activator_30.4.0\\HEU_KMS_Activator_30.4.0 1.0.0\\install\\0B07479\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\HEU_KMS_Activator_30.4.0\\HEU_KMS_Activator_30.4.0 1.0.0\\install\\0B07479\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34DF7CC1BFD18004BB4A5BE0090B4797\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3060	msiexec.exe
3060	msiexec.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe
3372	WindowsServices.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3060	msiexec.exe
Token: SeCreateTokenPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeAssignPrimaryTokenPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeLockMemoryPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeIncreaseQuotaPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeMachineAccountPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeTcbPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSecurityPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeTakeOwnershipPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeLoadDriverPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSystemProfilePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSystemtimePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeProfSingleProcessPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeIncBasePriorityPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreatePagefilePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreatePermanentPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeBackupPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeRestorePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeShutdownPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeDebugPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeAuditPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSystemEnvironmentPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeChangeNotifyPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeRemoteShutdownPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeUndockPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSyncAgentPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeEnableDelegationPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeManageVolumePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeImpersonatePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreateGlobalPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreateTokenPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeAssignPrimaryTokenPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeLockMemoryPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeIncreaseQuotaPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeMachineAccountPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeTcbPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSecurityPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeTakeOwnershipPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeLoadDriverPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSystemProfilePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSystemtimePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeProfSingleProcessPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeIncBasePriorityPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreatePagefilePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreatePermanentPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeBackupPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeRestorePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeShutdownPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeDebugPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeAuditPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSystemEnvironmentPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeChangeNotifyPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeRemoteShutdownPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeUndockPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeSyncAgentPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeEnableDelegationPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeManageVolumePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeImpersonatePrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreateGlobalPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeCreateTokenPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeAssignPrimaryTokenPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeLockMemoryPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeIncreaseQuotaPrivilege	640	HEU_KMS_Activator_30.4.0.exe
Token: SeMachineAccountPrivilege	640	HEU_KMS_Activator_30.4.0.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
640	HEU_KMS_Activator_30.4.0.exe
2756	msiexec.exe
2756	msiexec.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3792	3060	msiexec.exe	91
PID 3060 wrote to memory of 3792	3060	msiexec.exe	91
PID 3060 wrote to memory of 3792	3060	msiexec.exe	91
PID 640 wrote to memory of 2756	640	HEU_KMS_Activator_30.4.0.exe	92
PID 640 wrote to memory of 2756	640	HEU_KMS_Activator_30.4.0.exe	92
PID 640 wrote to memory of 2756	640	HEU_KMS_Activator_30.4.0.exe	92
PID 3060 wrote to memory of 1976	3060	msiexec.exe	98
PID 3060 wrote to memory of 1976	3060	msiexec.exe	98
PID 3060 wrote to memory of 4244	3060	msiexec.exe	100
PID 3060 wrote to memory of 4244	3060	msiexec.exe	100
PID 3060 wrote to memory of 4244	3060	msiexec.exe	100
PID 3060 wrote to memory of 3532	3060	msiexec.exe	101
PID 3060 wrote to memory of 3532	3060	msiexec.exe	101
PID 3060 wrote to memory of 3532	3060	msiexec.exe	101
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3532 wrote to memory of 5372	3532	Patch.exe	103
PID 3060 wrote to memory of 5280	3060	msiexec.exe	105
PID 3060 wrote to memory of 5280	3060	msiexec.exe	105
PID 3060 wrote to memory of 5280	3060	msiexec.exe	105
PID 5372 wrote to memory of 3372	5372	RegAsm.exe	114
PID 5372 wrote to memory of 3372	5372	RegAsm.exe	114
PID 5372 wrote to memory of 3372	5372	RegAsm.exe	114
PID 3372 wrote to memory of 1732	3372	WindowsServices.exe	116
PID 3372 wrote to memory of 1732	3372	WindowsServices.exe	116
PID 3372 wrote to memory of 1732	3372	WindowsServices.exe	116
PID 1732 wrote to memory of 5588	1732	cmd.exe	118
PID 1732 wrote to memory of 5588	1732	cmd.exe	118
PID 1732 wrote to memory of 5588	1732	cmd.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_30.4.0.exe
"C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_30.4.0.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0 1.0.0\install\0B07479\HEU_KMS_Activator_30.4.0.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_30.4.0.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727734831 "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2756

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1D897D8C57E22BF0B3E17304A1D82A8E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3792
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D1773B975CE82869F838C83CBDE839AD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Users\Admin\AppData\Roaming\WindowsActiveServices\Patch.exe
  "C:\Users\Admin\AppData\Roaming\WindowsActiveServices\Patch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe
      "C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFIIJJJDGCBA" & exit
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1732
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5588
- C:\Program Files (x86)\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0.exe
  "C:\Program Files (x86)\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4440,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
1⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=3896,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5892e7.rbs

Filesize
9KB

MD5
ad0f7e6c23bb44b05aee74539a98e9df

SHA1
b5e99945102e86b1777e2791a6bd885fd6c10859

SHA256
5b165208ef870a6bdeebfdb4100486832fe961b80de79014cf1e2f3cc1b38db1

SHA512
64755268de3cae16f4c69b0649c0cc603fa1939a5c4d7c87988772abb6d19639431f18cf1f86a64017c83ce800ed9f0315fb65099a47b067a88fa0ecd81dcbe6

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI589C.tmp

Filesize
378KB

MD5
0981d5c068a9c33f4e8110f81ffbb92e

SHA1
badb871adf6f24aba6923b9b21b211cea2aeca77

SHA256
b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68

SHA512
59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScriptTemp.ini

Filesize
153B

MD5
32a9ba7a0390d678060ad5b584cfa805

SHA1
06077c6769fe485e4fa64dd8a7aee40921a2f480

SHA256
6b8e280024ff7ed19f3baccb633d73aa17ae686dec66d2ea1e6972364a5add3e

SHA512
54a57befd56e4f1782f962d9b3f41079bfd76bb49f0690f65405dcdd16d828284e3ecc81cb81c22bd03097bf55bafb1434af0ea0534bc7ec8a4cb6255e50eccc

Download Submit
C:\Users\Admin\AppData\Roaming\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0 1.0.0\install\0B07479\AppDataFolder\WindowsActiveServices\Patch.exe

Filesize
588KB

MD5
2afbb4562f46e981beae497935002d3c

SHA1
8ede8d5c5551a8b6237a3c04f77b6f374e7c3539

SHA256
7b949ec5f73dff9e83d9c5e8995e025940f1ed6d3b07c27923d9321ca9a42ead

SHA512
112cc4a88078bfbadc86fe9e193b09307fe076be20b2080af968c8aea2d91ba691fe418444ea22b6c7e49dab9db4bb6b121f40e1aabef4219a4d62ab6fccab54

Download Submit
C:\Users\Admin\AppData\Roaming\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0 1.0.0\install\0B07479\HEU_KMS_Activator_30.4.0.exe

Filesize
4.5MB

MD5
362ff2681b18f1c682add6f6a673bed0

SHA1
d4cb5cd27192bd0f1d0d0ca5b2f75ebd40dda4a7

SHA256
6e93c12eb4921a6fccaf4c3f52d4776ac58fc850f939827964d8458ed3c60150

SHA512
7e17ba842c340f86e2a3a164356028f44938a3c17436b5764c6c24de54be1a32c99a1571416f6e8d96ae093c243ba5a3caa2b4186db7522a8cc45ac6dab7301f

Download Submit
C:\Users\Admin\AppData\Roaming\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0 1.0.0\install\0B07479\HEU_KMS_Activator_30.4.0.msi

Filesize
1.4MB

MD5
5899fa7fc7ca7d1eb2d79830ee5b6fcf

SHA1
5ff056dc9ba5e6605996a111fab531d3b27143a0

SHA256
86e61548eaa9dc8787da0a032d560a4b11c27bc2fb200d7a9a847956ad57e546

SHA512
5f979230425425e0094a7e4432144290d1135f04795f927b20a402e067f23ec2832f7827af1e0a892cf819c37cf35e468712ea3b527a70fc41b90fd2a2c34875

Download Submit
C:\Users\Admin\AppData\Roaming\HEU_KMS_Activator_30.4.0\HEU_KMS_Activator_30.4.0 1.0.0\install\decoder.dll

Filesize
202KB

MD5
2ca6d4ed5dd15fb7934c87e857f5ebfc

SHA1
383a55cc0ab890f41b71ca67e070ac7c903adeb6

SHA256
39412aacdcddc4b2b3cfeb126456edb125ce8cadb131ca5c23c031db4431c5fc

SHA512
ce11aa5bd7b0da4baf07146e8377ff0331c1d4b04aaa4408373b4dd0fe2c3f82c84b179d9a90d26cdaa02180f22276d96cf491f9ede66f5f1da6f43cc72e5ac4

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe

Filesize
384KB

MD5
e5eedc78a0a3ff607806e21ab267c553

SHA1
25192b22de6978b9a9ef2099e3d2091d5b3cb1ca

SHA256
ddf69adbff600c109b11204055b517b5fca9298e2765beac4e5a6fd762be4e9d

SHA512
58204f12909ebba7f9d3f2006da6c9562acbdbf9b14046ddc734294760900eee1e562c1b5e204c369851f95f3474a5545e66605e2405eefdf57fa6b254b85cd5

Download Submit
C:\Windows\Installer\MSI949E.tmp

Filesize
567KB

MD5
5f1b243813a203c66ba735139d8ce0c7

SHA1
c60a57668d348a61e4e2f12115afb9f9024162ba

SHA256
52d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2

SHA512
083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
db9e061bddcb035f0926558318ba635a

SHA1
e9a61fcb5d2a84f05244567e9cfd05e7f9d78c30

SHA256
8e9dd71b095c2be4f258ccc000250a9a4d23d5b4a2414ab353a5d6e26ae73953

SHA512
78058f572d3f5953da3b6ce4df5ec9a50d28c5b9c50a3e8a537ea5d3d2436f996ce522bfffc7d14718a4235ef801e15972cd1d13ac227dcb0b2452548daa7ff3

Download Submit
\??\Volume{ff3ab8f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2d8b84cd-5264-4fed-8c63-c4b37d36aa77}_OnDiskSnapshotProp

Filesize
6KB

MD5
cab4818f0fa91f9685aaa9cd397e9592

SHA1
a3ebd290f8688214699b3367e80ee17aeb3f307e

SHA256
8ffe05e2c19891929fa390cfb4b52d43b04b3bfedd1e416c5e0b147106d69265

SHA512
b79f7cf85d0c167d3111e0bfcbb1590471d72e619669adb5f379c7f5600638d82f11cb35ef2c57914e23e56252b690026470be1e6942a35a9fdea2adc0d5099d

Download Submit
memory/3372-907-0x0000000000440000-0x00000000006B6000-memory.dmp

Filesize
2.5MB

Download
memory/3372-773-0x0000000000440000-0x00000000006B6000-memory.dmp

Filesize
2.5MB

Download
memory/3532-85-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-97-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-115-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-113-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-111-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-109-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-105-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-103-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-101-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-95-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-93-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-91-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-89-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-119-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-83-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-79-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-77-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-135-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-75-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-127-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-73-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-107-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-99-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-117-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-72-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-724-0x0000000006740000-0x00000000067D2000-memory.dmp

Filesize
584KB

Download
memory/3532-725-0x0000000006630000-0x0000000006652000-memory.dmp

Filesize
136KB

Download
memory/3532-726-0x00000000067D0000-0x0000000006B24000-memory.dmp

Filesize
3.3MB

Download
memory/3532-727-0x000000003BAC0000-0x000000003BB26000-memory.dmp

Filesize
408KB

Download
memory/3532-728-0x000000003BF50000-0x000000003BFE2000-memory.dmp

Filesize
584KB

Download
memory/3532-729-0x000000003C5A0000-0x000000003CB44000-memory.dmp

Filesize
5.6MB

Download
memory/3532-70-0x0000000000980000-0x0000000000A18000-memory.dmp

Filesize
608KB

Download
memory/3532-71-0x0000000006590000-0x0000000006626000-memory.dmp

Filesize
600KB

Download
memory/3532-81-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-121-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-123-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-125-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-87-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-129-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-131-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/3532-133-0x0000000006590000-0x000000000661F000-memory.dmp

Filesize
572KB

Download
memory/5280-757-0x0000000000A20000-0x0000000001345000-memory.dmp

Filesize
9.1MB

Download
memory/5280-745-0x0000000000A20000-0x0000000001345000-memory.dmp

Filesize
9.1MB

Download
memory/5372-741-0x0000000005630000-0x00000000056CC000-memory.dmp

Filesize
624KB

Download
memory/5372-740-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download