vidar | 621b6076d404223bcecfd866f8fc2cee4c116320045eb916f7e6ace3feaea3fc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe
Size

6.2MB
MD5

6dc517f58f112adcdd3cfae606a67964
SHA1

b59f74642e963111027613ce0206ca77aec06fda
SHA256

2a559ce1ff609781226319d7f57d6c8cf32487bd87bb796ea43ee015aa104a73
SHA512

6f04ac98d9ea1eb203d2b93e9ff9f02a26b2ff61a4afc61b47f5d7f6260a80bc085fbc24c97c43407651c231156f468d4fe00cb152e64c6be948fed6b19f4ed8
SSDEEP

98304:cTiMEvjmzKewwsZ2XoCx7fR+Q6VCKrUk:iiMEaI24C1UQszrU

Score

10^/10

vidar credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 19 IoCs

stealer

resource	yara_rule
behavioral2/memory/1880-1-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-2-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-5-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-21-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-75-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-82-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-88-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-89-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-90-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-194-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-282-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-288-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-289-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-296-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-318-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-319-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-326-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-327-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7
behavioral2/memory/1880-328-0x0000000000400000-0x0000000000700000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4524	msedge.exe
4040	msedge.exe
3544	msedge.exe
4352	chrome.exe
2384	chrome.exe
448	chrome.exe
1680	msedge.exe
2172	chrome.exe
3156	msedge.exe

Loads dropped DLL 3 IoCs

pid	Process
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BitLockerToGo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5088	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133747951916378918"	chrome.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
2172	chrome.exe
2172	chrome.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
3604	msedge.exe
3604	msedge.exe
3156	msedge.exe
3156	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe
1880	BitLockerToGo.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe
Token: SeShutdownPrivilege	2172	chrome.exe
Token: SeCreatePagefilePrivilege	2172	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 2472 wrote to memory of 1880	2472	2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe	95
PID 1880 wrote to memory of 2172	1880	BitLockerToGo.exe	96
PID 1880 wrote to memory of 2172	1880	BitLockerToGo.exe	96
PID 2172 wrote to memory of 3144	2172	chrome.exe	97
PID 2172 wrote to memory of 3144	2172	chrome.exe	97
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 3188	2172	chrome.exe	98
PID 2172 wrote to memory of 4580	2172	chrome.exe	99
PID 2172 wrote to memory of 4580	2172	chrome.exe	99
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100
PID 2172 wrote to memory of 3484	2172	chrome.exe	100

C:\Users\Admin\AppData\Local\Temp\2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-30_6dc517f58f112adcdd3cfae606a67964_poet-rat_snatch.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff90221cc40,0x7ff90221cc4c,0x7ff90221cc58
      4⤵
      PID:3144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2100,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2012 /prefetch:2
      4⤵
      PID:3188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1960,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1892 /prefetch:3
      4⤵
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2472 /prefetch:8
      4⤵
      PID:3484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4428,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4680,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4728 /prefetch:8
      4⤵
      PID:4944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4496,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:8
      4⤵
      PID:4176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4676,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4932 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3164,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:3912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4740,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5124 /prefetch:8
      4⤵
      PID:2804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5176,i,10810375854019372780,6018194550783646979,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff901b846f8,0x7ff901b84708,0x7ff901b84718
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2644 /prefetch:2
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15906856078921172087,14912500068033384318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3648 /prefetch:2
      4⤵
      PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IIIECAAKECFH" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3752
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5088

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\chrome.dll

Filesize
676KB

MD5
eda18948a989176f4eebb175ce806255

SHA1
ff22a3d5f5fb705137f233c36622c79eab995897

SHA256
81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

SHA512
160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5006e1e4aae2d56bc915bd8a2c74b55e

SHA1
f66c7ae361f8c420962529451b152c62c3dcd94d

SHA256
aded6ff4898a723466ac9bb1a4d753cedff9c01891ab88be0cea6fbec612863f

SHA512
a8acb434037895850d7d6db69a4e011fc3e38ff4b170bdbd1f3e427a5dd59ce8296864fd88c0e677d3153d146e61f65f9f652de2398aab94573903c5bf5fb62a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
418B

MD5
d967c51f1781ee7d143cbf972a943bbb

SHA1
7ef452228682f737276bebc36d7a42c7e875f7ae

SHA256
eeb3776f041981be2d145875727c52e1acc09b0efd3a95bc5c7bdaded5886c0c

SHA512
6064018a495f1af5de6f1ecb8f54bf6a3fd21642366423d4bb41393186a36d83823bb6ce7de97e0c947e74809177f388157361ee31e914e270df8467f37adb03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0807a2b8-ad45-4a45-be66-d9c409494b35.dmp

Filesize
823KB

MD5
4e06ae8f69fbac19541549eab6b581f0

SHA1
44ff587c61d3f881045fc80914683179413309b6

SHA256
0e75b9bd0ca6c3bee9c4051aacf454359018c923690bcc80ff52cf8db717e2aa

SHA512
62633459b36f1d968805c5f956f183c9f101f141fe7f81ff2d4f7589265c5fb1e31ff40d0053fb217386de8fcb74f934d5526271926f8d6a89fa6f4a6204c6ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\1ef8d547-fd55-4660-81bc-28f9bc6038de.dmp

Filesize
827KB

MD5
b562987d909f781d9e6ae67f58360e62

SHA1
ab1cfe69d1b7a7e85332a31e19178b27b7b2554e

SHA256
c12ab06633e6f4580822937dbae6e3c40c521fc8643347dae5d5e9d19de3f457

SHA512
3200cb05585726989f4d60f4abeec27da93a5cc2f30ae082c5fc5a2454dc7a4697616f9d83261f39e67eb018cad2e9b88e49277ddc5ddb039db8fb373cba2b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ed3b41bf-d035-4bcd-a967-edef2e09aa3a.dmp

Filesize
825KB

MD5
db319497429979cf11fb10be82300c91

SHA1
c05f92c58ea1a9e1973648e28afe1e114462f8de

SHA256
52bf9db067b372c4ef57b2e13690f8d6c9cac81555c2f0cbfcb4d58d9bb3fe35

SHA512
af60277947c65d796e78ef4bfe540a402f1f69ffaeca5f371aa5318471d0a853b2496e5a7874cf0b647ded07dcab5fe52109e014d31bdf1d67c6160b54c7e124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ef87baab-576c-4c11-98a8-723ea7e37554.dmp

Filesize
838KB

MD5
f31e02ac23a1d1616afb29ee5db5a3ad

SHA1
df8b9a4e0d2ec806718a414e30198ea8da1a554f

SHA256
9d9a9ce26f60b558f2b5650f49fdc323f405a80986a4412aae6450fb8a430467

SHA512
f3904c4103972f51482f999673c4a2bca4f1a5d79e78de9333bedeee267e17647611ea96c3b94946a2f78d33af52724a5ac0304afe7e156e17c6010164d2856a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
168f822a5dace72dfa8128cf1bb15b6a

SHA1
35bf56e39a85519c64db56a43a7751a352715a33

SHA256
aa0be7b6886e87219b4a60b9c4df3cb9e71c2feae323ce67d3b20f96b88fab57

SHA512
ef47e592f90383a7b6eda103d22e20bc3008da2544dd60f434260c6c002c8e378fcb6e758bfa76b0daad64bf1e69ad765446eb89996723229d6aef69adc993fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
117d7619b193743633822041b62e81ad

SHA1
27ce2972c5f2b552493ab29b399b86850f41e5b8

SHA256
5f30197ffe565740f34161a08daabe9e82b57355969edf9b6ed65e0db24aa304

SHA512
360b8be19d65296deeb833d88b0c42456319720702daefb3cd90d679079ecf5896c2cac25050db8e6a5a5c6a448442865e6e3204e845b189c0edc61a52354bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e9efbf6f61d9ca851de70f5a62b180b

SHA1
399c46ed4d2f67fcf03bcb2fbdc06aed75456fcc

SHA256
01bcbba0f0222880970c49cbbaefc1fc1c6aa0e3b3d34a37ffef0b661eb6ac62

SHA512
ee28c627f530e21b5bcf9c2e610d2e21b75d3ebc00bf184df9fc54c6227ed308d3ed012f91cfcec969ab4e558ab44fe8986f7815d23ac43ab76748321a370d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
memory/1880-75-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-288-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-89-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-88-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-82-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-194-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-0-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-23-0x0000000019B90000-0x0000000019DEF000-memory.dmp

Filesize
2.4MB

Download
memory/1880-21-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-5-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-282-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-90-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-289-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-296-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-2-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-1-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-318-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-319-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-326-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-327-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/1880-328-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download