stormkitty | hxxps://github[.]com/luis22d/ZeroTrace-Stealer/releases/tag/zerotrace3[.]0[.]0[.]0

Analysis

max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-02-2025 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/luis22d/ZeroTrace-Stealer/releases/tag/zerotrace3.0.0.0

Score

10^/10

stormkitty collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

resource	yara_rule
behavioral2/files/0x001900000002ab8e-245.dat	family_stormkitty
behavioral2/memory/4200-248-0x00000000007D0000-0x0000000003320000-memory.dmp	family_stormkitty
behavioral2/files/0x001b00000002ab93-305.dat	family_stormkitty
behavioral2/memory/1172-307-0x0000000000680000-0x00000000006BC000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Executes dropped EXE 2 IoCs

pid	Process
4200	ZeroTrace Stealer.exe
1172	Build.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Build.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ipinfo.io
3	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	1172	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZeroTrace Stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2304	cmd.exe
1592	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Build.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0.rar:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
4620	NOTEPAD.EXE
3104	NOTEPAD.EXE
1684	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
1144	msedge.exe
1144	msedge.exe
4388	msedge.exe
4388	msedge.exe
3916	identity_helper.exe
3916	identity_helper.exe
3520	msedge.exe
3520	msedge.exe
4200	ZeroTrace Stealer.exe
4200	ZeroTrace Stealer.exe
4200	ZeroTrace Stealer.exe
4200	ZeroTrace Stealer.exe
1172	Build.exe
1172	Build.exe
1172	Build.exe
1172	Build.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4200	ZeroTrace Stealer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	4640	7zG.exe
Token: 35	4640	7zG.exe
Token: SeSecurityPrivilege	4640	7zG.exe
Token: SeSecurityPrivilege	4640	7zG.exe
Token: SeDebugPrivilege	4200	ZeroTrace Stealer.exe
Token: SeDebugPrivilege	1172	Build.exe
Token: SeDebugPrivilege	3980	taskmgr.exe
Token: SeSystemProfilePrivilege	3980	taskmgr.exe
Token: SeCreateGlobalPrivilege	3980	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
4640	7zG.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4200	ZeroTrace Stealer.exe
4200	ZeroTrace Stealer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1128	1144	msedge.exe	77
PID 1144 wrote to memory of 1128	1144	msedge.exe	77
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3500	1144	msedge.exe	78
PID 1144 wrote to memory of 3444	1144	msedge.exe	79
PID 1144 wrote to memory of 3444	1144	msedge.exe	79
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80
PID 1144 wrote to memory of 2980	1144	msedge.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Build.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Build.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/luis22d/ZeroTrace-Stealer/releases/tag/zerotrace3.0.0.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff45a23cb8,0x7fff45a23cc8,0x7fff45a23cd8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16196765098038760107,18323285582716830927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2680

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\" -spe -an -ai#7zMap15215:112:7zEvent3660
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4640

C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe
"C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\Build.exe
"C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\Build.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2304
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1592
- - C:\Windows\SysWOW64\findstr.exe
    findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 2480
  2⤵
  - Program crash
  PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1172 -ip 1172
1⤵
PID:4668

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3980

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\181.215.176.83\Browsers\Firefox\FirefoxBookmarks.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4620

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\181.215.176.83\Browsers\Edge\EdgeHistory.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3104

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\181.215.176.83\System\Process.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e27e9c3ebd81d610675662ee4a5e1a61

SHA1
1ebf6debd280688b4122af9121a41d2abb99282a

SHA256
74a993b3e9cbcaf61e288ca6196ca195430048839d58c86a9f33209c202fd7a4

SHA512
b1a73a6126a5272c4d7672f6bd1e44bcb725f541c73ade7bca57329de809ab78982c61652d6794626f526708ae953eea3964cd70af89c70eb4d677bbf7efae53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
7d566c6b02f9393b126ec56ee20fb6c2

SHA1
b5950c870fa00c051b66b83469d03f03d226b1f3

SHA256
bb2086c30a673c1414592223a38d46cac4191df0c558b035c04911fcaf386a30

SHA512
913eb658c4ae43256e751ac0046bfb0d84f77114d94374528d892b3f7e97e881465bcebd1e70180f85a1cfa49c1ea6757420620465ae7a08991afd6bcea5ddd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
804cf8eccc5cd4d9169b2cfdc19222ec

SHA1
6909a790a8db80decd6889a8a953ee4028471803

SHA256
a69ca22bd2459f025515f4322a91c75771ca8aaf187178f3a5e7c469e2f819bf

SHA512
eed5bdf922c7581166d1688b91c77e23c9ccddf79c8778b4a325278b6aedcb86c979c0298086d48ee4481867013683d900f4050c9933837034dfef929271cd91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0406339370d5cb9883983de46192e305

SHA1
7995b2b38824f2afee18b5e0a202fabb1ccc6ad4

SHA256
fea55aea2c6cdb8e58c6aa253b4a4e6ead3eb1c2ce51abedc8ab803a3bbf0197

SHA512
9cee223c7ee2932ad70a0a9b5fe8790a2bf2c57375343bd2c3810ac08a115c58c26f557f575a14ad59ee9439474b8136626e3a9138f0f6b237b288bdaa8b4647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3590f693359d78992d4855b81bb263bd

SHA1
bb37b6223132db87319e07ae20862ab051731c19

SHA256
7796277a51b0fa1b5f371e7813544e48d403ecd564cd7718397cba26ef4ce03e

SHA512
5978ebf9e870c0bea4faaada134bbc9a738cf437fa0a1d36b52992947d22a7225934aabe70967cd77a5a3fea53f6e7e0e958093b37b8ed4adf71f30e20bff487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eacd.TMP

Filesize
1KB

MD5
31c957f1fc6925dbb076746d95758fd9

SHA1
958cdc4885370c1b76d57cfd578ee1af10b0e5e7

SHA256
73943e67f984feedef42b7299952c3edc22f178a64b1f474c9210bd96dc7438d

SHA512
da72547d771fec01a92587933155eabbbcded8f1c37a070f35328a2f3cd8b19e7ee8f42dba84fbc04958e9b3b7cd3e104cb0ac3593ab544a3a41a9a0d1b6f847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7d94306-f1b2-4934-955a-0d3f490d298c.tmp

Filesize
496B

MD5
1b92794633aaa7d8ca83e408ef516a36

SHA1
4ae0678d6cf8abedb3e9819fc9d7d715d3f72bb6

SHA256
0ff76dc871bd6e59abe386781ef988b4c8d734bca726a4d1eb556d3d78f1e7e0

SHA512
698bb4adf1932dd48fbffb344b0053b9dc753b97a92d88a26341e0c3b0fa2e03481c5193bd2b4a1caaa2aa2f00e41eae73c53aaadc1ac6bb8be17d0f229a61bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d04c7bf8-b9f9-4e2a-b3b6-f245c8e2069d.tmp

Filesize
5KB

MD5
a3dd2c7364604fc65595a459b8e1e160

SHA1
fbb8ceaff2831dacddb668560fb0fa0c23d13f2c

SHA256
174f44ba76dc6fad20ecc6be511b469feac4ad552ebe43cc14e893bdb413cf23

SHA512
8ba02561dd43656d3941a2194430767660d44580da34166e4cd09502c3c60214addab02a94628baeb21ce3d33a8f862f02b52c717701db89564cb5d97786dea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ca1949a53b05104f0a6fe25db4042078

SHA1
7015a5a761c4a4c34e99b84580a1178799589fb6

SHA256
945af5c9f52a1952b71d699af7f8367be78b047d6370aab120f3abd0df446d0e

SHA512
7d7382a71d62f2f8f053a2a2c8cc8173f704d6c6ec1b68b4d0abea50b7eda398831d64dcce49d7112073e154c360f19777c273b2be1e75b08cbcae5e362ee422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74ed68b0d743260b57551ff5ced7dd3f

SHA1
6fb6ec743079948be9dded9342088d1de1df7ea6

SHA256
4a3088da02eeec3f0d370965ce2c1c97097063a310287d6888f427e4b61aa66c

SHA512
5d2e562570493bb051df9da469bdc9c4f28ea3caa9bd2afed573ba97d2c523e4fe5ee14fb16cc852688a2586ca811372178fee366bdeb91039929db20f90ed08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0f0bc622e1a18c542a4edb1c35d6b48

SHA1
923022f0fcc6251606f6065c13589bec1932597b

SHA256
09af52ba83eda906b2eb5f8d57ee911b493eef86f9b121422b2742adc6358ae5

SHA512
b346bc9c8ef4e78e4fc5d09a943ceb4878321b1f9b71e50104753ed75f175c239c36f8bdf4e363e5d7caa61f3c82267d17bec534939dfda2ad712a10d3a18baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.83\Browsers\Edge\EdgeCookies.txt

Filesize
653B

MD5
3cb78b39f9521d1d8ec206a4d250a46c

SHA1
cd71db05f94e118789ff8037eecfe873732be3c3

SHA256
a2ba093c6b553cbc67b3d1117aef45762cd5bbcf34c36da7adc4556bdb8e0ef5

SHA512
6824d870ee2d75e6451e02f225ce1698c4506cc34409483f58acc5ab018d6b9b15c0669553a70f6238cf98d4a3536b7ab6d04491520024deb535aa20fd79962e

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.83\Browsers\Edge\EdgeHistory.txt

Filesize
215B

MD5
8d5db31ba4c9fe72759fa54b180f3ec0

SHA1
cad4d2f21967f0c0230246ac30e4b3e38b3a64ea

SHA256
6482db2fec1e19809816e32a8923d16aeccbd4e118f9cd13f808ca9ef87fedfc

SHA512
0aac9ea5f8404bc402c7717040574232d70e8962a533543516d684fcc01d21fab74b738b8111079dfb831ea0dda4047d97c5a099bd33dff6b777a3a5d9ce89d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.83\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\181.215.176.83\System\Process.txt

Filesize
567B

MD5
84fef0b82c8b11017bbfb52cf1900efa

SHA1
38bb52f045914b3d34046416b30b9b746fa9435a

SHA256
dbe91df9fa079ac2a6c1492db956eb7731319cd1f1025b7bd504d2cce1cf39f7

SHA512
cc749810188370bdb22d80b313bc312bf9aa73a7faa0f8943607040458fcedf9d3640776813082ccad92f538a95f609e0e1695c54151e9486617b1312115055e

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0.rar

Filesize
43.1MB

MD5
038ce7d123192a66eaa0665546953096

SHA1
4b86ce5260f675bae04ee537c9b0291055c93dfe

SHA256
d0eaf37ea3abe951a153679030365dcbb8645975c78d076f1fe37d48b692fa3d

SHA512
d570f8d85424eae34f2c63cb2a5c26942476cf00fbb69669933a23bcd25cda495eb2723b2b2af8e1a48469230b14d8bb2901d03f2a168184b21d5121f56b2bd8

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\Build.exe

Filesize
214KB

MD5
8bcc564e3987ed598db185967f3f14d3

SHA1
1e8d5706c455a3e7890c1a4f6aac319c0d4b0b6b

SHA256
9aea9338df04fe677f9fee2723bed5c8ab25393718f482d11c1d611cb44542bc

SHA512
486c523e2a270f8eba74fa173b0ab05ca159d1d464f4ee5440f9cb63f03b3d7a1a2f5c0b80dba401f603dec9829d170bac51f9c270ebb1c3a2c5083736f6af62

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe

Filesize
43.3MB

MD5
9296b5203bf25a88838ffa143b78572b

SHA1
adfc70e2e726c1903265d4326c65324cf66e23f4

SHA256
4bd7af6fd6483bb9f6e0c1881d80f6b48b4903ad61e3933c769d6921e28fc546

SHA512
4794f6b4dce9190e5fdbf78f30be41531362a75768621f92db636a6e003c400478efc6bdfeab678a8ba30a486310598025c8b8077f9668c004394bdf2ffa7147

Download Submit
C:\Users\Admin\Downloads\ZeroTrace.Stealer.3.0.0.0\Release\ZeroTrace Stealer.exe.config

Filesize
1KB

MD5
d6580e30f9677b44b8533d65499d1273

SHA1
2a977e5f66f5017c4b25309650e830df46412ae0

SHA256
1b7568f2437f88ec3fb1e71bd73d9c293a8f7fcf6c96e84a7525cecf55d562e7

SHA512
7e71e9ee7e79f4bec97fc1e964b2fd9a96a60855f6020b4389861382457f7b7d570704be1e9cc894d4a644049fabd8cc1266976bce2d746b246a3cd583400945

Download Submit
memory/1172-307-0x0000000000680000-0x00000000006BC000-memory.dmp

Filesize
240KB

Download
memory/1172-310-0x0000000006770000-0x00000000067D6000-memory.dmp

Filesize
408KB

Download
memory/1172-309-0x0000000005150000-0x0000000005312000-memory.dmp

Filesize
1.8MB

Download
memory/1172-308-0x0000000004F60000-0x0000000004F72000-memory.dmp

Filesize
72KB

Download
memory/3980-373-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-376-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-371-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-375-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-374-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-364-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-372-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-370-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-365-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/3980-366-0x00000227EE1B0000-0x00000227EE1B1000-memory.dmp

Filesize
4KB

Download
memory/4200-254-0x0000000008F40000-0x000000000973A000-memory.dmp

Filesize
8.0MB

Download
memory/4200-248-0x00000000007D0000-0x0000000003320000-memory.dmp

Filesize
43.3MB

Download
memory/4200-249-0x0000000008410000-0x00000000089B6000-memory.dmp

Filesize
5.6MB

Download
memory/4200-250-0x00000000099C0000-0x000000000A07C000-memory.dmp

Filesize
6.7MB

Download
memory/4200-251-0x000000000E530000-0x000000000F8C4000-memory.dmp

Filesize
19.6MB

Download
memory/4200-252-0x00000000082F0000-0x0000000008382000-memory.dmp

Filesize
584KB

Download
memory/4200-253-0x00000000089C0000-0x0000000008F36000-memory.dmp

Filesize
5.5MB

Download
memory/4200-255-0x00000000080F0000-0x000000000820A000-memory.dmp

Filesize
1.1MB

Download
memory/4200-271-0x000000000CD50000-0x000000000CDB0000-memory.dmp

Filesize
384KB

Download
memory/4200-260-0x000000000DC30000-0x000000000DC50000-memory.dmp

Filesize
128KB

Download
memory/4200-259-0x0000000013E60000-0x000000001438C000-memory.dmp

Filesize
5.2MB

Download
memory/4200-258-0x0000000009940000-0x000000000994A000-memory.dmp

Filesize
40KB

Download
memory/4200-257-0x0000000009740000-0x0000000009840000-memory.dmp

Filesize
1024KB

Download
memory/4200-256-0x00000000128C0000-0x0000000013E56000-memory.dmp

Filesize
21.6MB

Download