vidar | d28bc1b8975df8985c266826dc2111d6c50989fce391f72327171df965231166

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2025, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe
Size

556KB
MD5

d510396277a666720627f5df62bd53eb
SHA1

7acf176af54493aac227097b01a38242c069c28b
SHA256

d28bc1b8975df8985c266826dc2111d6c50989fce391f72327171df965231166
SHA512

e459a1212969aecd935bcf1182ad887b7cc5319ebf1b489ae9bc3a18e2855994de46ab7ff8a7d6f968ff844b8beac243bd3b4b2fd6a572bfc1ad0a689c960154
SSDEEP

12288:sgSCNzaLuvMRXdxQBXZqEvRXJQNf+9LKLdEEo4Edka+9LKLdEEo4Edk:sgvFaKQdEOaKLdjRaaKLdjR

Score

10^/10

vidar c466785b3a34d7b3c4d6db04a068b664 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

c466785b3a34d7b3c4d6db04a068b664

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 36 IoCs

stealer

resource	yara_rule
behavioral1/memory/920-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-31-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-75-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-85-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-86-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-87-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-91-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-100-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-548-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-704-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-705-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-708-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-709-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-710-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-711-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-715-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-716-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-717-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-718-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-719-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/920-723-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 10 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1544	msedge.exe
2096	msedge.exe
2172	msedge.exe
2164	msedge.exe
1168	chrome.exe
2184	chrome.exe
3264	chrome.exe
1452	chrome.exe
4376	chrome.exe
4772	msedge.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3644 set thread context of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4472	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133896326787302658"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-83325578-304917428-1200496059-1000\{F48BAB2A-0708-4696-992A-22285448D74A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe
3264	chrome.exe
3264	chrome.exe
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe
920	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe
Token: SeShutdownPrivilege	3264	chrome.exe
Token: SeCreatePagefilePrivilege	3264	chrome.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
3264	chrome.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 3644 wrote to memory of 920	3644	2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 920 wrote to memory of 3264	920	MSBuild.exe	97
PID 920 wrote to memory of 3264	920	MSBuild.exe	97
PID 3264 wrote to memory of 4808	3264	chrome.exe	98
PID 3264 wrote to memory of 4808	3264	chrome.exe	98
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 3068	3264	chrome.exe	99
PID 3264 wrote to memory of 4848	3264	chrome.exe	100
PID 3264 wrote to memory of 4848	3264	chrome.exe	100
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101
PID 3264 wrote to memory of 4468	3264	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-20_d510396277a666720627f5df62bd53eb_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffdd2ddcf8,0x7fffdd2ddd04,0x7fffdd2ddd10
      4⤵
      PID:4808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2012,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:3068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2268,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2300 /prefetch:3
      4⤵
      PID:4848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2296,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2416 /prefetch:8
      4⤵
      PID:4468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3260,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1452
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4308,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4288 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:4376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3880,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5316,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4856 /prefetch:8
      4⤵
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5400,i,13654836287014347440,13967393109018882682,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5412 /prefetch:8
      4⤵
      PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fffdd2bf208,0x7fffdd2bf214,0x7fffdd2bf220
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2164,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3560,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3572,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4204,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4224,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5228,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3868,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5116,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4456,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6568,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,3321078266356538673,1328525107931798173,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
      4⤵
      PID:1840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\op8gv" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4472

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
51b2096065b52bf3de97533fbb8197f7

SHA1
bc2c43e14ee94f85997672b2085e48846832a4b6

SHA256
e0f9a4304f9d22d43bd409b78a7ae213affbc982062bcff61974f625792a364c

SHA512
f9f8c3fc77f99e3c3c3a6a632dec534b319844a9d97d94878567b4195a3cef10884ae74ed4f17970b0fa4c4270e1f8953dc422dc3cb4c7ad16e5911ec9991b0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
7a3af40ea78a26f51f87021a1325a77b

SHA1
49674579b63f0ca81db29c1f27c3b4814625e3be

SHA256
04dd2c2ca9c8e534ec5fb2abcbf0fec5864197f633bfe976e4b9f519cddcc8aa

SHA512
053c1e9766ea06e10c14fd10ee6a0da6685fb61d1997b0086444a3713194a8ed8cb33e0ec9932cd5d71cfc48a9bf702d89a01ba64e780aad0545274487d6e7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
5a7e1750438748bd333b79a94ca69b2a

SHA1
94fd1be56969e269ce195ba29c3d464d356d6556

SHA256
6d7a64a318c25c643323d5cf1c0c80ccf2f2433e7d74b722fca90468f8f9b914

SHA512
842509c0f495ee24d152ab3f7867183d7cd64b01b5a9305405682abbbff3aa18a8ad7d97ee039393fdd1766fc17ad2df1caf711dc4db8dc7b9df608ffc0fdc7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
eec55fe349980566b1dbf1d409d28c3e

SHA1
654ce4b550defea0851f12e8ff81ae9298bb3f60

SHA256
2e81ea3d7ddfc0274f3955d5131143c481e63f2529514c5295873b393d508efe

SHA512
58e02658d08732b5f36e868331a483b5fde15475a6c5f704a19c97d920399c3f7d41a8fa163c66683bf403598f8f48f0cf9fa468f9783fcabd9136a55cec0059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6a380d4-5862-40a9-a645-ceea7f421bc5\index-dir\the-real-index

Filesize
1KB

MD5
fad6ba902473000f41090b6319298137

SHA1
8f6cf20e54f518f0421d2d147dc71e6a261deeaf

SHA256
75bb0c961099cc8cf2a3b7e27b19d9f0b18f8eb24b0e14d4a3acca9691e233a6

SHA512
45d2455d0a4b666098930a6cc1ef32461b5d6ad6edf7492b05a8490709035fa6163568ae70b39d54f5d166774a8f978e4ffd3c49ca8cdace40ef13c5e2d813eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6a380d4-5862-40a9-a645-ceea7f421bc5\index-dir\the-real-index~RFe57b527.TMP

Filesize
1KB

MD5
785f1de0c212e529058a03c1e9a35ffc

SHA1
2d293a32cb40cc43dc1ba766bfff447d84901f12

SHA256
b59a6f72fa9fbc3b94bc33db72e759176ce97bc55a6f35e705ddc97bcb5d672f

SHA512
6fb114e153e0635aa65721e122e396facd24626375b36c169bae4f97599348d227a45a59944869a6a54915e7f880918b1b3ec2cb3d477f71542815e109ec0893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
4747e30405b43992cf4d6ea80c2179de

SHA1
663f7b8f018e115d1096aa0796d447db4b70610f

SHA256
f50b9b0b256e9dcfa43157c792258bbd6cae9987e6e65710c90d7fbd922688c2

SHA512
e24d7c967a844028369a8d5ba556b48bf6e44f5a4aec211fc73bc4f34b7c1a3830dbc29893475236b540bf9efe0d99e2b3311f8a04387fbca5ac7d50f7e5c3cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
4c5803a0b70c05e7563c2521ad754054

SHA1
79d1ba96ec11421e7721faa899d6702a9d15040d

SHA256
b4b97cfa914b8ffe4388845bd7724f69e9a9c1931a3f096738283f4a561098ff

SHA512
483ce0c664d8ff52ed4efc91052c5cae7828fc7a2505b95584f3828d24c1e69d29bfbf0d8589e932f8a3244125cc599a8b6fd7af82f68c8ae960237081468698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
b554ec8002b50ec90631641cb005fb1e

SHA1
754c0ec14342e450087fffc358c534c7c8a74dda

SHA256
a0c9bf71b2da95a82e99798d498820450c6f09fdbd0d0e33ab87d27f80732f28

SHA512
c3f2dbe420dcaa917002ee6a6674f29973d0b54890bfbf92014f6d49a45a14300ee5343868d54354c9848a4e3c708df42ce46349cdea8321de7026dc3541a7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
a17bbbb84e2bc830cbeec85de96d7e51

SHA1
6c65183a522d47726ba2817ede3d9db54317a212

SHA256
85218bf526a6d931c59264522bafc5edfc8702a69c7982875f877b0c19141773

SHA512
2e64f521d61e5f97c7f488eb76612df4f837fbd7cd17b571c28cb86d21fba624efea46d6dea393ad5f985fee9ac7293c6e533b0bc78702f8d7b31ceaa32d9199

Download Submit
C:\Users\Admin\AppData\Local\Temp\36de179d-2ceb-4bae-bcfd-551a688b84d1.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\ed552500-ed44-4a78-a380-4548d72f1253.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4772_319001586\71f40fdc-8c41-4913-8f9b-1c9aeb6ddd4a.tmp

Filesize
153KB

MD5
b0917d8e6c5b6be358bff67f84eb8336

SHA1
a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d

SHA256
dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

SHA512
cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451

Download Submit
memory/920-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-81-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-85-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-87-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-100-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-548-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-710-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-704-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-705-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-708-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-709-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-711-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-715-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-716-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-717-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-718-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-719-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-723-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download