4ddb12ed1e4e6ff13c3d93763a652de7df620141941c62f617cd0c39fd5747e5

Analysis

geolocation tags

eueuropefrfrance
max time kernel
898s
max time network
399s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pro/Capcut pro activator.exe
Size 3.3MB
Sample260620-ndh89aev9r
SHA256 4ddb12ed1e4e6ff13c3d93763a652de7df620141941c62f617cd0c39fd5747e5
MD5 e9116b95465d073cd84cf266070b19b2
SHA1 691046d8839d38efb56ad2f971854876e6aa5e01
SHA512 bc765208db8cd999d30152ef451ab8fea5e5161fc7919f157a8b11f1fdddd28fe51ed6247e1d61fd9b41dedd0caa09175813bd0e1705fab6557d3047a04a41d8
SSDEEP 49152:8co8WHnjaGL9wPHq1wPB2PRARwWctmT4tXjblvZirM:8ZAKJQGmctZ4M
TLSH
T19AF57C07FCD599F8C42962318ABA5A827725BC091B3267D72A61B7787F723C03C32765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 5988 created 2028	5988	Capcut pro activator.exe	80
PID 5988 created 4360	5988	Capcut pro activator.exe	81
PID 5988 created 5824	5988	Capcut pro activator.exe	82
PID 5988 created 2008	5988	Capcut pro activator.exe	83
PID 5988 created 1968	5988	Capcut pro activator.exe	85
PID 5988 created 4644	5988	Capcut pro activator.exe	86
PID 5988 created 4492	5988	Capcut pro activator.exe	87
PID 5988 created 5748	5988	Capcut pro activator.exe	89
PID 5988 created 2028	5988	Capcut pro activator.exe	80
PID 5988 created 2028	5988	Capcut pro activator.exe	80
PID 5988 created 2008	5988	Capcut pro activator.exe	83
PID 5988 created 2008	5988	Capcut pro activator.exe	83
PID 5988 created 5252	5988	Capcut pro activator.exe	92
PID 5988 created 2400	5988	Capcut pro activator.exe	93
PID 5988 created 5656	5988	Capcut pro activator.exe	95
PID 5988 created 2060	5988	Capcut pro activator.exe	96
PID 5988 created 4564	5988	Capcut pro activator.exe	97
PID 5988 created 4740	5988	Capcut pro activator.exe	98
PID 5988 created 384	5988	Capcut pro activator.exe	99
PID 5988 created 5252	5988	Capcut pro activator.exe	92
PID 5988 created 5252	5988	Capcut pro activator.exe	92
PID 5988 created 5656	5988	Capcut pro activator.exe	95
PID 5988 created 5656	5988	Capcut pro activator.exe	95

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5988	Capcut pro activator.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	chrome.exe
5656	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Capcut pro activator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Capcut pro activator.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264280962265053"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{1A19E869-D0C9-4F51-8E7E-56C3EBBC48CA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
2028	chrome.exe
2028	chrome.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe
5988	Capcut pro activator.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
5252	msedge.exe
5252	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	Capcut pro activator.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
5252	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 2028	5988	Capcut pro activator.exe	80
PID 2028 wrote to memory of 4360	2028	chrome.exe	81
PID 2028 wrote to memory of 2008	2028	chrome.exe	83
PID 2028 wrote to memory of 5824	2028	chrome.exe	82
PID 2028 wrote to memory of 5824	2028	chrome.exe	82
PID 2028 wrote to memory of 4492	2028	chrome.exe	87
PID 2028 wrote to memory of 4492	2028	chrome.exe	87
PID 2028 wrote to memory of 1968	2028	chrome.exe	85
PID 2028 wrote to memory of 1968	2028	chrome.exe	85
PID 2028 wrote to memory of 4644	2028	chrome.exe	86
PID 2028 wrote to memory of 4644	2028	chrome.exe	86
PID 2028 wrote to memory of 5748	2028	chrome.exe	89
PID 2028 wrote to memory of 5748	2028	chrome.exe	89
PID 2028 wrote to memory of 3852	2028	chrome.exe	90
PID 5988 wrote to memory of 5252	5988	Capcut pro activator.exe	92
PID 5252 wrote to memory of 2400	5252	msedge.exe	93
PID 5252 wrote to memory of 5656	5252	msedge.exe	95
PID 5252 wrote to memory of 2060	5252	msedge.exe	96
PID 5252 wrote to memory of 2060	5252	msedge.exe	96
PID 5252 wrote to memory of 2060	5252	msedge.exe	96
PID 5252 wrote to memory of 4564	5252	msedge.exe	97
PID 5252 wrote to memory of 4564	5252	msedge.exe	97
PID 5252 wrote to memory of 4740	5252	msedge.exe	98
PID 5252 wrote to memory of 4740	5252	msedge.exe	98
PID 5252 wrote to memory of 4740	5252	msedge.exe	98
PID 5252 wrote to memory of 384	5252	msedge.exe	99
PID 5252 wrote to memory of 384	5252	msedge.exe	99
PID 5252 wrote to memory of 384	5252	msedge.exe	99
PID 5252 wrote to memory of 5924	5252	msedge.exe	100
PID 5252 wrote to memory of 5924	5252	msedge.exe	100
PID 5252 wrote to memory of 5792	5252	msedge.exe	101
PID 5252 wrote to memory of 5792	5252	msedge.exe	101
PID 5252 wrote to memory of 5492	5252	msedge.exe	103
PID 5252 wrote to memory of 2448	5252	msedge.exe	104
PID 2448 wrote to memory of 4708	2448	msedge.exe	105
PID 5252 wrote to memory of 1236	5252	msedge.exe	106
PID 1236 wrote to memory of 5364	1236	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\Pro\Capcut pro activator.exe
"C:\Users\Admin\AppData\Local\Temp\Pro\Capcut pro activator.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3946c728,0x7ffa3946c734,0x7ffa3946c740
    3⤵
    PID:4360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,8563545972908692364,3607790614467926052,262144 --field-trial-handle=1952,i,1994181903693991611,4128693535935115130,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:5824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,12459946731091604129,9825872231539382417,524288 --field-trial-handle=1952,i,1994181903693991611,4128693535935115130,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,11472824306403531134,11613907549723547189,524288 --field-trial-handle=1952,i,1994181903693991611,4128693535935115130,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2644 /prefetch:13
    3⤵
    PID:1968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,13612750804912571236,5764549105394947568,2097152 --field-trial-handle=1952,i,1994181903693991611,4128693535935115130,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2972 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,8775212956321930235,16382821454314023505,2097152 --field-trial-handle=1952,i,1994181903693991611,4128693535935115130,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2996 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,11725185409668630850,992748505299409382,2097152 --field-trial-handle=1952,i,1994181903693991611,4128693535935115130,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4188 /prefetch:9
    3⤵
    PID:5748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,8680666536131525062,3524817702342313665,524288 --field-trial-handle=1952,i,1994181903693991611,4128693535935115130,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa15bec188,0x7ffa15bec194,0x7ffa15bec1a0
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,2420454618133497276,9849510812816223801,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1656,i,11948699663879691115,17261081559722178045,262144 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,2501760180651555925,8704222903147017605,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,12789061749655525781,2450123131271639364,2097152 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,13555073623650701938,5270324467577263847,2097152 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,2159954837242279692,18161021349763909395,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,6660326271011508056,7841786592309863783,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16954688073833927337,881075515702187198,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16954688073833927337,881075515702187198,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,2778220074078196196,17602146864338907984,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,16473104588971665747,12999797333759101713,524288 --field-trial-handle=2224,i,5920027791809429172,48045193666939144,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=596
      4⤵
      PID:5364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 89ac05afdbca2bc20e3d70b37d8c7203d6ae025ab722fa8c579604bd7627c670
MD5 a8dc98872317b6852aad608e34f614ba
SHA1 0b2d119b521802021d91e0e5d5d66f7250c33a49
SHA512 2f54be8c324a951e83fb6bb28a66cff66f9bdacbba49abeb4e8301b2230417741676f02e16f38d4a18c283863e2abaad85eeb86f1bf53e60fc501a2f4a68c65a
SSDEEP 192:XRDXTq4d1I15zv7+pAPRp2O9wHsb+WNnfbPNTUbWP+VyIsnAUgtaJ:XRDDlo5L6UXpOwTPpP28
TLSH
T1A342B72EBA50693B5CD7C229F9217753D7F5103161992E84E6FC8A2C19E79CD221702F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 facd91505d4d79d55c0ec52a49beea610a2f381000d73b60e213e5b884725f3b
MD5 068a174b504197f507bf6c63005826a0
SHA1 b31ade0be1d4609d3e3bc65c47dc899194aeb3ab
SHA512 56769284ae431cfbd5f221a45d75d97f7c4d5ca0d4fd0da939544617f89b39c6071a465c6348513789fb842d7e8522e4f6b32e97dadcfcf6aa2310ef192bce57
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OyTJSVumdnr:1nbZeMrv/hGtyTJcnr
TLSH
T165D3864B3A747102EDE5DA721CE050BB5D3CB16D8F55A5D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cf92507de72ece3e94ce6d871e18ff04bbe4c1ac292c0f1cc1ca16f25fdcf775
MD5 8f2e77e66cd57cf93e017b79dc9cd557
SHA1 e5e1369ed45cef4ed55065022b5528ad7675e01a
SHA512 f53ed1a459e71f9bcd40fc147448ed961da35efce73ad774d1bccb9a051bd882ba2b96c09388849f7114b2ca7daf73ff7b1065b06a6a2b1885ad6b85bd937221
SSDEEP 3072:wzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:eWDfxA3OnjrYQ9EU0/hEg
TLSH
T11EC302A15C35BD660CB8EE98744C3F60BFF4AD9A91879DC362ED1B0D24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b2e93415de22c98d5711ca9585878e39534ed7ba2764aaea3df57e27f4391dcd
MD5 95887735f614c2ba3e8c9be5dec3f273
SHA1 33093352935ae01ab05f1c7f4df1f0d156b788cb
SHA512 eaa15f833242a55d773e027049edeeb83e9c0c957dd0e3df54a849942157f9b264d8b4d90c8166f9f69ed96786e1614d9a3e3b9aa377339310f2fdb311ab3a9d
SSDEEP 6144:NGdhKrjUr5uJolNUuLcPsP68WDfxA3OnjrYQ9EU0/hE2:NjrjAm/sSFDfxjjs+C1
TLSH
T11A3412A11D2BBDA6097CEE28349D3E323ED4AD5790875CD615B82F0F14FACC80626E75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 823e88d8be1873cf27043787d281bf95a2ea16e19e68d07518e16b7f3db4c661
MD5 5a2d850c93873a33cc429e372d4a2df0
SHA1 028a8318ce5b406b0d98cfd4a1f1e9865e7be185
SHA512 20c02efc437a4a9c89fe8202605e5b1290f216df19bcd5a88124191559e6129ce4a854e7df18a1382bfc82543d08b7b9799516bb0310abc8108ae4022b9263e4
TLSH
T1B6E0E5A6C822DC2B08F9075879504646D60113762E40494F3A3D8208CFB862A15D691C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 22db06f6c2f931ff19fc938af82a1a057a17443cf8b96edda5c5746670ed6790
MD5 55218713e3f45ade18b6cf8c5f9bd667
SHA1 c8ddc217db63da2caa39be60669d10dd45e85f8f
SHA512 eb869e626ec6a6b9e9186dcd9a910da575d0c8d2fa3640ce440150930e610c86b6c35fbbe09ff563b42908466f71e61e83ad99d51c571f2c7e67bc683c2c36ed
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlFpHD:ctGj+BCNC5qFVpKxFZD
TLSH
T1C9B28A1632BA02033C3D791D87A59B371A42B1633428E93B7BE854B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 24776a95a7b463a0ab222d899e433a8a3cbf0379cce5ec2ef2dc3b90cca64200
MD5 b2e8c60f4cead9b01fd43b25c6b314c0
SHA1 31d7c7eb5a5e19bfd28ff779c1c5e00da6f268da
SHA512 f8c86ed0cec4c975f2d611d45d825212cf9d7778ddfbf3ea6de4e660dd0733d23b1e7f9e22ab291612ac632cb3c5d1053085ac90afc3f9fc47bfdbe595c2cdab
SSDEEP 192:FvoWTJfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aWfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T13224640A7B747001EDE7E9725CB080771A3CB16DCF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4a9a784b9aa0b9d0cc02d2f7f1710e15cf8fa97bcc9d7c94eee388c28e405846
MD5 ee5693a46c7b4004584c9dd7681c7f33
SHA1 c86d9a589874d60b7862de88560afdb5dd976d76
SHA512 9f8e21f6145cc7e64f99be0bb29c85209fc430fdfbc865a40926a1581e9220a3a9f10dd5f4e0ed0b417a690f9ab8ca6a60a8c6ed0088c26a7034d6352204cee4
SSDEEP 384:nWiF9CcmyWCs38NI8TUNTUlIxBrk6hA1891zCfbLo/4AXf8Rae4KV8p0Ajty/7IQ:9Fccps3Pwg4/8rOo/PERaI8p07
TLSH
T1A0C26B32ECA8CAA7EDD74F99B74E7903DEE0526781889AD4DDD81D4D008B19D130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 975be3e6ab39d8c043313ec664e2d538dd478881b2954d7729fe0dd93d2ffe7a
MD5 5af537d0a52c2d2232f9865f336b45af
SHA1 c4889892a145cca315b24734421f3cbf4a24ba84
SHA512 a2c87390b6faf8aece027ed31c2e2e1676865859b9ed151d8f9a3bb1f79c2f8c3769c050fd949ac266fe4c4969dcddc824abb0858e24483018829b275a76c52a
SSDEEP 384:nbiF9CcmyWCs38NA8TUNTUlIxBrk6oBCF1zCfbLo/qSSe4KV8p0Ajty/7Igj:2Fccps3bwg4NCzOo/qSSI8p07
TLSH
T14DB26C32EC98CAB7EDD74F99E74E7A03DEE0626786888AD4D9D81D4D00871DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1ce2d20

Path C:\Users\Admin\AppData\Local\Temp\f1dcdff7\a1ce2d20
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5988-114-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-103-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-15-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-46-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-63-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-68-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-115-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-139-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-137-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-150-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-136-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-135-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-134-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-133-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-132-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-131-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-130-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-129-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-128-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-107-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-104-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-101-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-100-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-117-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-13-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-116-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-113-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-112-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-111-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-110-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-109-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-106-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-105-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-14-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-102-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-99-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-98-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-97-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-96-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-95-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-94-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-108-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-71-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-67-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-66-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-65-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-64-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-61-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-62-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-60-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-59-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-12-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-11-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-9-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-10-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-8-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-7-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-6-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-5-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-4-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-3-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-2-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-1-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-0-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-58-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-47-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5988-2233-0x0000000490000000-0x000000049021B000-memory.dmp

Download