vidar | 7c1bb5e9ae1bf20dc9aafb0605b15bd688f7d5e23db424e019315f412f11ec42

Analysis

max time kernel
138s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2025, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe
Size

808KB
MD5

7f8e5fe3443a730c3b55e170ed25e7a8
SHA1

5ad4bb5a34b5906f99eb3bdedb48bc517d18136b
SHA256

7c1bb5e9ae1bf20dc9aafb0605b15bd688f7d5e23db424e019315f412f11ec42
SHA512

e9f7a3565868a606906d757bb1e751586685038761e8aba38e3c9156235a1280d23fbe950ccb45d545d854d545da714bb07b90ee8eaf1b28f10214fca612f516
SSDEEP

12288:zbGU3fK+OmAeJWcl28vZ2CYizu+9LKLdEEo4E7ka+9LKLdEEo4E7kaEO:vGU3bNkAuaKLdjDaaKLdjDat

Score

10^/10

vidar 0259016785c18ed951c497596f76958c credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

0259016785c18ed951c497596f76958c

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 33 IoCs

stealer

resource	yara_rule
behavioral2/memory/3868-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-11-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-12-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-17-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-18-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-21-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-26-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-27-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-31-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-35-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-85-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-86-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-90-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-91-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-903-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-904-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-905-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-908-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-910-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-914-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-915-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-916-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-917-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-918-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-919-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/3868-920-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5580	chrome.exe
4568	chrome.exe
2664	msedge.exe
5304	msedge.exe
6120	msedge.exe
5172	chrome.exe
3092	chrome.exe
5668	chrome.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2996 set thread context of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133896147338767858"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{65361640-67A8-45E6-9667-DAE31200C4C8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe
5172	chrome.exe
5172	chrome.exe
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe
3868	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5172	chrome.exe
Token: SeCreatePagefilePrivilege	5172	chrome.exe
Token: SeShutdownPrivilege	5172	chrome.exe
Token: SeCreatePagefilePrivilege	5172	chrome.exe
Token: SeShutdownPrivilege	5172	chrome.exe
Token: SeCreatePagefilePrivilege	5172	chrome.exe
Token: SeShutdownPrivilege	5172	chrome.exe
Token: SeCreatePagefilePrivilege	5172	chrome.exe
Token: SeShutdownPrivilege	5172	chrome.exe
Token: SeCreatePagefilePrivilege	5172	chrome.exe
Token: SeShutdownPrivilege	5172	chrome.exe
Token: SeCreatePagefilePrivilege	5172	chrome.exe
Token: SeShutdownPrivilege	5172	chrome.exe
Token: SeCreatePagefilePrivilege	5172	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
5172	chrome.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 2996 wrote to memory of 3868	2996	SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe	78
PID 3868 wrote to memory of 5172	3868	MSBuild.exe	79
PID 3868 wrote to memory of 5172	3868	MSBuild.exe	79
PID 5172 wrote to memory of 4728	5172	chrome.exe	80
PID 5172 wrote to memory of 4728	5172	chrome.exe	80
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 3708	5172	chrome.exe	82
PID 5172 wrote to memory of 3708	5172	chrome.exe	82
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 5028	5172	chrome.exe	81
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83
PID 5172 wrote to memory of 4896	5172	chrome.exe	83

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.18984.6671.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88f33dcf8,0x7ff88f33dd04,0x7ff88f33dd10
      4⤵
      PID:4728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1944,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1940 /prefetch:2
      4⤵
      PID:5028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1988,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2112 /prefetch:11
      4⤵
      PID:3708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2376,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2352 /prefetch:13
      4⤵
      PID:4896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3252,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4380,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4432 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4720,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4636 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5332,i,14684325101103501997,15701528807967300127,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ff88834f208,0x7ff88834f214,0x7ff88834f220
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2132,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2508,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4712,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5756,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:3548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        5⤵
        
        PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6268,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:2352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6356,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6356,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6372,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5656,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6148,i,14232018008031933858,7761652246898742344,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
      4⤵
      PID:5684

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
57e088d610406fb012f23284084ff6b1

SHA1
11348533449b0f2cce938e66e8f3b42f38800450

SHA256
628f21ebcd4467197e473280d1603a27d1188c15e001c1b8f614015fef2db125

SHA512
06d51dcf2dd2edb5f5493928705ca95c48ea649959bd1339b18368ed82e6415da296de111325a2c8d854166fbb02f66ac81eccab5a28f806ef49dee6311ede79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
58c6a80ed7d341bc2f26df0ac4caad6c

SHA1
af9f9b539065374763417c8a93c8ea2490ae96d2

SHA256
89cb56aa7fb9f916a0cbd5a35e210781943db10ab850b5586fca066f049d366d

SHA512
d639078a4cd47ef2891ca65f9c8c4a07d21461722c08bed3a3893ec58e6436abd9ab8c643c96cfb400f013e375c8a2339912e30d93d0992813950bd102d10090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9e4597d6e9951c90f605fa4a330843b2

SHA1
c9a4c72aba3b9584e03d0db43aee91e51094c369

SHA256
272d838982199dc905b6eea7f57fc331c216efacab7d865cf427fa4972aff009

SHA512
adbf3948d11ce019ee5a0e8971b7b08567c7a3de742e03274ae0bd868f64f4d09e93e91e38681b34eb017af7d4708e5484b776b9b3828715d05f35621423fe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
c613c767c05d3f1d7d12f3fc3c665e40

SHA1
e272e7b23fe33b04004051532b9d76ad4b5d5148

SHA256
862a853d64c76d64234434eeb5edf3c85778a89d4744eb62243b9c25e8280a5e

SHA512
dd1804f81b650218306f346cd4604d9cbaddfe6e0e43090b63eec5e6934805369a1207d3d10b279f95f0fb653811332b3a59445840ed3b3eb3cc7fbc4aa5dcc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
9af15eaf25a114b36a0722bf5d3cad47

SHA1
9086f092fc1bd18c2f18ed5adfe6e7c77f2404d7

SHA256
65db0c1055b1e707e0c4e152f1106112fd78cc5464c2fa00d8bfa9d85bfd6ea4

SHA512
6b1eddb6d77eb99d2a71c0d61e07e23b0a45abd3dd9fd58b7000d98e2d9d2f20b6322486a68e81931d7cb8230afd05179c23f0f8c4cd6e51fec655cbd84959b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
f3f8f1a3ff2e6d1411a6cbfd3ecd98f8

SHA1
b9a82d7d3d2f3995ac3af1cbd2a3908f1a3fe654

SHA256
a17356e6eb72dad5cfdfbf847327a91c861a7e23ffaa3baaf658c61daa12bbd7

SHA512
8c6028dba42748920e63aefd50dc67a8d1db1a035e65afd894479668e6bf42d94e075b361dc59300677c8aa0f33c8ab209f817d82107267a21eb91e1ae5eb07c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5417672-d12f-43cd-a1db-5f60f28ef2d9\index-dir\the-real-index

Filesize
2KB

MD5
ba634b3d354b9cbb004318ca65134da1

SHA1
d973865c01fb6d0fea66c940d86664ad8da14365

SHA256
577812915409e732dcfb0fb360d6462e7f8318059a8c381efbd6f42d3950382a

SHA512
86057f92cd3fead84acf7eaa02b75cc3d9b5f8371c52859c696da4dd83a7b71171d59677ca554385844220d84e208958f307c86e34f9b963ef6746ca4626f89a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f5417672-d12f-43cd-a1db-5f60f28ef2d9\index-dir\the-real-index~RFe582d64.TMP

Filesize
2KB

MD5
89fe9e7bd36c1e473a38bcb10a6a25db

SHA1
d5ada51e29da645ff58af43d65c6510e8d94d52f

SHA256
b3642405438c09ec65cdfb3c56886eefb1a5601c57be4e9516c4fb2855c3d9df

SHA512
0370b8e9f59b1a72f7a84d52297ef5380bd5ba8b874b2cd1f1593973a2a2b4233b4658c2620e3aee309499fb3fa5ceb702f13210f14e0bc0b35f993c4cf51e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
56ba2e5a78484444c14d6726ac31de28

SHA1
fd1976d441370c927bc61e3f8f9d683b635be484

SHA256
97cb08b03e12c8e458be49730b3fc092f7ca739f409747e037b0850d61c5fb2b

SHA512
f0145ab67b4d5f6a3a53710f0bd80e5274ae046d1c1602ce46500f6fa8e1d8345cf9d5b256e7cc19e0ea5a287c45991b37bcd2cf866077cda5d7d410e7a97f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
d025473f17caf787b12ea035bd0b0150

SHA1
3899a5243757ae0f7b4b1d6590a3a1f89cfc8d3c

SHA256
165a53ecec74f5f081839ecf2726761e050def52cacb7a82eae9ce03b41ab6c7

SHA512
3c1c465a679f5b4de38d3c506fbf76b73419ed3edb4b1e5396ceb256cb5fc0bc535b9f055e280c84efe2f3016d27ad3b7ae5fcd8165f45ca40da4e962f837032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
9c158d36d5490508ae36b32f33dcd0ce

SHA1
d7e53b8b18aa6095214f0bbc2c94708b44a02ab6

SHA256
7707f979fa2635feb6427b20b3308a208a38fcf7b442128116c2ba43b90b8fad

SHA512
2885bd02d7016455bc6572cfeaa0515488f9f9e527d9374a45962af8c718b86beed20aa98c9b3794ab0dc0afcc05a108d8e800c7dc4ecec86b79670c7b9b93e4

Download Submit
memory/3868-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-81-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-85-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-27-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-903-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-904-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-905-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-908-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-910-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-914-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-915-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-916-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-917-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-918-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-919-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3868-920-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download