vidar | a84c53037ecf5ba9db3d05ed58d835a960973dfba8946c94e9bfa6838ee12a4b

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
11/12/2025, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 8.5MB
Sample251211-ab462stlem
SHA256 a84c53037ecf5ba9db3d05ed58d835a960973dfba8946c94e9bfa6838ee12a4b
MD5 d994ab0bb21c653f2e22e94e8f457835
SHA1 dc2014ab3653e07344d20dde248ffe45bb86939e
SHA512 391ff51b81f3e02308017072e960f8b4c5a575e34e19f536b0ce6f86918557a92f68f9253adeaaf33a9f5f8990062fb8100f10ff92c067966e4155a5802908df
SSDEEP 49152:BWxAK3xWyq9jEIzWzdzMrq1KcUR6ykdU6xK1X:lK3x5q2I+dgr0KcYJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dadf4dfb4414faa707e84357dfba40dd discovery vidar spyware stealer

Malware Config

Extracted

Family

vidar

Botnet

dadf4dfb4414faa707e84357dfba40dd

https://steamcommunity.com/profiles/76561198761022496

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/5984-1-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral2/memory/5984-31-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral2/memory/5984-144-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral2/memory/5984-155-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
4920	chrome.exe
4920	chrome.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe
5984	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
5932	msedge.exe
5932	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
5932	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 4920	5984	file.exe	79
PID 4920 wrote to memory of 4932	4920	chrome.exe	80
PID 5984 wrote to memory of 4920	5984	file.exe	79
PID 4920 wrote to memory of 5124	4920	chrome.exe	81
PID 4920 wrote to memory of 1972	4920	chrome.exe	82
PID 4920 wrote to memory of 1972	4920	chrome.exe	82
PID 4920 wrote to memory of 1132	4920	chrome.exe	83
PID 4920 wrote to memory of 1132	4920	chrome.exe	83
PID 4920 wrote to memory of 824	4920	chrome.exe	85
PID 4920 wrote to memory of 2216	4920	chrome.exe	86
PID 4920 wrote to memory of 824	4920	chrome.exe	85
PID 4920 wrote to memory of 2216	4920	chrome.exe	86
PID 4920 wrote to memory of 5744	4920	chrome.exe	87
PID 4920 wrote to memory of 5744	4920	chrome.exe	87
PID 4920 wrote to memory of 2796	4920	chrome.exe	89
PID 4920 wrote to memory of 2796	4920	chrome.exe	89
PID 5984 wrote to memory of 5932	5984	file.exe	91
PID 5932 wrote to memory of 2544	5932	msedge.exe	92
PID 5984 wrote to memory of 5932	5984	file.exe	91
PID 5932 wrote to memory of 800	5932	msedge.exe	93
PID 5932 wrote to memory of 6028	5932	msedge.exe	94
PID 5932 wrote to memory of 800	5932	msedge.exe	93
PID 5932 wrote to memory of 800	5932	msedge.exe	93
PID 5932 wrote to memory of 5212	5932	msedge.exe	95
PID 5932 wrote to memory of 5212	5932	msedge.exe	95
PID 5932 wrote to memory of 2828	5932	msedge.exe	97
PID 5932 wrote to memory of 5796	5932	msedge.exe	98
PID 5932 wrote to memory of 2828	5932	msedge.exe	97
PID 5932 wrote to memory of 2828	5932	msedge.exe	97
PID 5932 wrote to memory of 5796	5932	msedge.exe	98
PID 5932 wrote to memory of 5796	5932	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5571dcf8,0x7fff5571dd04,0x7fff5571dd10
    3⤵
    PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1888,i,9945889964938061522,8942124102860344527,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    PID:5124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1996,i,9945889964938061522,8942124102860344527,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:1972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,9945889964938061522,8942124102860344527,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2528 /prefetch:13
    3⤵
    PID:1132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,9945889964938061522,8942124102860344527,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,9945889964938061522,8942124102860344527,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:2216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4192,i,9945889964938061522,8942124102860344527,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4220 /prefetch:9
    3⤵
    PID:5744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4608,i,9945889964938061522,8942124102860344527,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4632 /prefetch:1
    3⤵
    PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x310,0x7fff556ff208,0x7fff556ff214,0x7fff556ff220
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,2969139356160228061,3128487799185326761,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,2969139356160228061,3128487799185326761,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2476,i,2969139356160228061,3128487799185326761,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,2969139356160228061,3128487799185326761,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,2969139356160228061,3128487799185326761,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:5796

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1192

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 c0e2c77e6e9a8149476c027b99babf1347f1b56a3be832873df083977bd25f4e
MD5 5d2cea91e54815b8709af5b94a5e6204
SHA1 fdd145699fd549a9d77387071f5ad2707a361b21
SHA512 6b56808510a8195df49bc7d896b94c26e36e468f3d36b48c5eaa315ec47563149e7cbf3bddf41470d8f80d7b5811f54a77a7e2cd04220f1cee5dd47486e91071
SSDEEP 3072:TXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT9:TWMExki2KL64sbWRtHqldg+G/M9
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 863a93e5b785f842cd565785014122277827259ee2147df74f1207f843029053
MD5 65ead42c5186d990ceca40bf07ae2e69
SHA1 d187a1e12de13a08e06df521d30e90ae67a81c08
SHA512 2035564c277c602160c3ab714a73b9b84df08a52967e3247fdc1fb8bab89fed86cf7f50f64438ea73bd4880ef68576af373265df5bf12663b3e185dc44cba243
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6ebfcf6efefd0fe583714a0e6420b9fdee99c35b952c265edcc92b0af8c8fc7e
MD5 38777a76e269c7ac8f98fb280bcac0b9
SHA1 7cc166308be0765353ab992b4f8ab823cf2417a5
SHA512 3f388c0182770f0b97819e8c69758fac4fd216e6029b077699611d80880807f81f84d7a3add1afd816529d16c14af7c47634477eb688dbee17e548a632bb8a92
SSDEEP 768:2F5BLv7I5wCPFdV6Zi63UCgJdfw6wiypa4qGBS2gfLdOocywM9jC:+JUV6ZL3+dfa4dQLM9jC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 069e8a8853b41eeaec7b277bc897a550444a5a352d692f2283bcbe15caa579c1
MD5 bd9a7c3f88202e2c4840cdb84688c2ab
SHA1 b95f880351d628501f397f01547c3d3db4936e5b
SHA512 4728f4a85cea77ec635d61ed4c743aba43532a2e9a553d55a233cec926e01ede1caa2df4f2e2bae80f56b1fa881885653175a138b3c2eacdc2878666d14cfca5
SSDEEP 768:iF5BLv7I5wCPFdV6Zi63UCgJdNZwiypa4qGBS2gNGBD1WGwfocywM9jC:yJUV6ZL3+dOwGCNLM9jC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5984-0-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5984-1-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5984-31-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5984-144-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5984-155-0x0000000140000000-0x0000000140189000-memory.dmp

Download