gcleaner | 11f50bd71ee026c644b2322d84b4a3e03b48455e34ebf478bd6afc32e0fdfbef

Analysis

max time kernel
299s
max time network
187s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/06/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 2.1MB
Sample260628-s42whaas4p
SHA256 11f50bd71ee026c644b2322d84b4a3e03b48455e34ebf478bd6afc32e0fdfbef
MD5 b953f81730955b8883bc2e8baa9091e6
SHA1 e2885a36319e84ef9c8decc8d261192b13590754
SHA512 1d94892ff03f18cc211fa1c58f38b6ce7fcd33cd9f8e25f5911a6f2b25095948ecae49d384de17c2f2f52041cb58235201d50072974afbdd34acbf790ab4a0bd
SSDEEP 49152:06xcx0yWUn9t6egjwYrmG2K7wzs4aDleN:06Ij9t6egsYrmGF7iwD4N
TLSH
T1E9A51219D7F405FDE0B6E5B8CD824A51EBB17C4D07A1E6CF03A4A9A61F27290CD3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gcleaner loader spyware stealer

Malware Config

Extracted

Family

gcleaner

185.156.73.98
45.91.200.135

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4728 created 3360	4728	acr-m2.exe	57
PID 4728 created 3360	4728	acr-m2.exe	57
PID 4864 created 3360	4864	lapismixtwo.exe	57

Downloads MZ/PE file 10 IoCs

flow	pid	Process
104	2124	svchost.exe
104	2124	svchost.exe
104	2124	svchost.exe
104	2124	svchost.exe
104	2124	svchost.exe
104	2124	svchost.exe
104	2124	svchost.exe
104	2124	svchost.exe
104	2124	svchost.exe
116	2124	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 12 IoCs

pid	Process
4728	acr-m2.exe
4864	lapismixtwo.exe
1176	dBecEGdik.exe
4952	jTMxeObNsQ02.exe
3224	nBS5gGmqJKvO.exe
3656	Pq7KlE6tkq7.exe
1340	vOrXPnMpsO.exe
3532	ECtLj0kXhQzF0.exe
5956	Yevefi.exe
3624	f9ePtBORIh2Iw.exe
2164	IgX3qI1gs5N.exe
1308	1QJbLO5Q7aS.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4728	acr-m2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4864 set thread context of 2124	4864	lapismixtwo.exe	113

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acr-m2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lapismixtwo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ECtLj0kXhQzF0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yevefi.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5504	chrome.exe
1144	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4020	chrome.exe
4020	chrome.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe
4728	acr-m2.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4728	acr-m2.exe
4728	acr-m2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4020	chrome.exe
Token: SeCreatePagefilePrivilege	4020	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
4020	chrome.exe
3120	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4728	4780	Setup.exe	82
PID 4780 wrote to memory of 4864	4780	Setup.exe	84
PID 4728 wrote to memory of 4020	4728	acr-m2.exe	85
PID 4020 wrote to memory of 5272	4020	chrome.exe	86
PID 4020 wrote to memory of 5504	4020	chrome.exe	87
PID 4020 wrote to memory of 3344	4020	chrome.exe	88
PID 4020 wrote to memory of 3344	4020	chrome.exe	88
PID 4020 wrote to memory of 3536	4020	chrome.exe	89
PID 4020 wrote to memory of 3536	4020	chrome.exe	89
PID 4020 wrote to memory of 6060	4020	chrome.exe	91
PID 4020 wrote to memory of 6060	4020	chrome.exe	91
PID 4020 wrote to memory of 3944	4020	chrome.exe	92
PID 4020 wrote to memory of 3944	4020	chrome.exe	92
PID 4020 wrote to memory of 5372	4020	chrome.exe	93
PID 4020 wrote to memory of 5372	4020	chrome.exe	93
PID 4020 wrote to memory of 3060	4020	chrome.exe	94
PID 4020 wrote to memory of 3060	4020	chrome.exe	94
PID 4020 wrote to memory of 2412	4020	chrome.exe	97
PID 4020 wrote to memory of 2412	4020	chrome.exe	97
PID 4020 wrote to memory of 1868	4020	chrome.exe	98
PID 4020 wrote to memory of 1868	4020	chrome.exe	98
PID 4728 wrote to memory of 5316	4728	acr-m2.exe	99
PID 5316 wrote to memory of 3120	5316	msedge.exe	100
PID 3120 wrote to memory of 2568	3120	msedge.exe	101
PID 3120 wrote to memory of 1144	3120	msedge.exe	102
PID 3120 wrote to memory of 5376	3120	msedge.exe	103
PID 3120 wrote to memory of 5376	3120	msedge.exe	103
PID 3120 wrote to memory of 5376	3120	msedge.exe	103
PID 3120 wrote to memory of 1672	3120	msedge.exe	104
PID 3120 wrote to memory of 1672	3120	msedge.exe	104
PID 3120 wrote to memory of 2728	3120	msedge.exe	105
PID 3120 wrote to memory of 5360	3120	msedge.exe	106
PID 3120 wrote to memory of 2728	3120	msedge.exe	105
PID 3120 wrote to memory of 2728	3120	msedge.exe	105
PID 3120 wrote to memory of 5360	3120	msedge.exe	106
PID 3120 wrote to memory of 5360	3120	msedge.exe	106
PID 4864 wrote to memory of 2124	4864	lapismixtwo.exe	113
PID 4864 wrote to memory of 2124	4864	lapismixtwo.exe	113
PID 4864 wrote to memory of 2124	4864	lapismixtwo.exe	113
PID 4864 wrote to memory of 2124	4864	lapismixtwo.exe	113
PID 4864 wrote to memory of 2124	4864	lapismixtwo.exe	113
PID 4864 wrote to memory of 2124	4864	lapismixtwo.exe	113
PID 4864 wrote to memory of 2124	4864	lapismixtwo.exe	113
PID 2124 wrote to memory of 1176	2124	svchost.exe	116
PID 2124 wrote to memory of 4952	2124	svchost.exe	118
PID 2124 wrote to memory of 3224	2124	svchost.exe	121
PID 2124 wrote to memory of 3656	2124	svchost.exe	123
PID 2124 wrote to memory of 1340	2124	svchost.exe	125
PID 2124 wrote to memory of 3532	2124	svchost.exe	127
PID 3532 wrote to memory of 5956	3532	ECtLj0kXhQzF0.exe	128
PID 2124 wrote to memory of 3624	2124	svchost.exe	129
PID 2124 wrote to memory of 2164	2124	svchost.exe	131
PID 2124 wrote to memory of 1308	2124	svchost.exe	133

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\acr-m2.exe
    "C:\Users\Admin\AppData\Local\Temp\acr-m2.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\lapismixtwo.exe
    "C:\Users\Admin\AppData\Local\Temp\lapismixtwo.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff9c70fc728,0x7ff9c70fc734,0x7ff9c70fc740
    3⤵
    PID:5272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,18371411519713337072,14315285119203990908,524288 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1856 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,13423870858922677540,11246055081441737195,262144 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1808 /prefetch:2
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,17978850674058843186,5313618157860813052,524288 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2288 /prefetch:8
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,18407072824898351886,2007060062799096726,2097152 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,3111764064884169783,11592771402431652687,2097152 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4236,i,11244589062625659032,11344276220637680576,2097152 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4244 /prefetch:2
    3⤵
    PID:5372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4568,i,15834471197796214339,1252985616170213850,2097152 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4324,i,11806465056963516424,16217758873654054085,524288 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4404 /prefetch:8
    3⤵
    PID:2412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,17483982645220115931,15629524775046414721,524288 --field-trial-handle=1744,i,17194455614608440313,5300383073814927219,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window --edge-skip-compat-layer-relaunch
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ff9b70dc188,0x7ff9b70dc194,0x7ff9b70dc1a0
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,16097428528801001471,4325253017652416600,524288 --field-trial-handle=2196,i,1961149286408629598,17801439983556568950,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      System Time Discovery
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1748,i,109301673782734789,4608067154471753928,262144 --field-trial-handle=2196,i,1961149286408629598,17801439983556568950,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,2480176520486313852,362999061937952404,524288 --field-trial-handle=2196,i,1961149286408629598,17801439983556568950,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3296,i,10225003684271689518,5096337204991810414,2097152 --field-trial-handle=2196,i,1961149286408629598,17801439983556568950,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3300,i,16058137116557626815,14180457877888646166,2097152 --field-trial-handle=2196,i,1961149286408629598,17801439983556568950,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:5360
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\lapismixtwo.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Users\Admin\AppData\Roaming\pGSucDO\dBecEGdik.exe
    "C:\Users\Admin\AppData\Roaming\pGSucDO\dBecEGdik.exe"
    3⤵
    - Executes dropped EXE
    PID:1176
- - C:\Users\Admin\AppData\Roaming\TOkEVP\jTMxeObNsQ02.exe
    "C:\Users\Admin\AppData\Roaming\TOkEVP\jTMxeObNsQ02.exe"
    3⤵
    - Executes dropped EXE
    PID:4952
- - C:\Users\Admin\AppData\Roaming\ZFcsJO\nBS5gGmqJKvO.exe
    "C:\Users\Admin\AppData\Roaming\ZFcsJO\nBS5gGmqJKvO.exe"
    3⤵
    - Executes dropped EXE
    PID:3224
- - C:\Users\Admin\AppData\Roaming\LUOhM\Pq7KlE6tkq7.exe
    "C:\Users\Admin\AppData\Roaming\LUOhM\Pq7KlE6tkq7.exe"
    3⤵
    - Executes dropped EXE
    PID:3656
- - C:\Users\Admin\AppData\Roaming\jr6USeRO\vOrXPnMpsO.exe
    "C:\Users\Admin\AppData\Roaming\jr6USeRO\vOrXPnMpsO.exe"
    3⤵
    - Executes dropped EXE
    PID:1340
- - C:\Users\Admin\AppData\Roaming\7uGMei8R\ECtLj0kXhQzF0.exe
    "C:\Users\Admin\AppData\Roaming\7uGMei8R\ECtLj0kXhQzF0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\ProgramData\Zusuha\Yevefi.exe
      "C:\ProgramData\Zusuha\Yevefi.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5956
- - C:\Users\Admin\AppData\Roaming\OR14tLhMSzL\f9ePtBORIh2Iw.exe
    "C:\Users\Admin\AppData\Roaming\OR14tLhMSzL\f9ePtBORIh2Iw.exe"
    3⤵
    - Executes dropped EXE
    PID:3624
- - C:\Users\Admin\AppData\Roaming\95iVvq\IgX3qI1gs5N.exe
    "C:\Users\Admin\AppData\Roaming\95iVvq\IgX3qI1gs5N.exe"
    3⤵
    - Executes dropped EXE
    PID:2164
- - C:\Users\Admin\AppData\Roaming\YK7E0r\1QJbLO5Q7aS.exe
    "C:\Users\Admin\AppData\Roaming\YK7E0r\1QJbLO5Q7aS.exe"
    3⤵
    - Executes dropped EXE
    PID:1308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9273b69a958423e2ea6ab6da09e4fd5633ae48f5c7f2ab39f4fa0bc91f373b7a
MD5 2cb0ecda980080419ae0bf19419b31fa
SHA1 7ab34b7cce32ad0200a64189df58c5223d28cca7
SHA512 4582a8a117c1bcb2ca361ef9892dbc8568d75d7d59ed14628d120b0ad045521cfebdd20214b0ae308f57ea7856b4d3803fc3431fbd891bfe736cd7c8e2e9ee2d
SSDEEP 96:eNC0d++nHQU0Ttfy95z4CRDotok5x0D9B6PJGyvyL9QNzHBC1Zwh11a:eNC0RHCw955DUDAjo0N9QNzHBC1q1s
TLSH
T11AB1E9B6D8698C77557A85C5F5066B06CFB8F0EBE660AE9899DD0F0D01EB0E81302532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 3f5d122da8a3612a08d2ffa48372a90d56fe076eb4584633746139f7d47d7e7e
MD5 2f76fabd4ae9ef8fe9a6fcc5b0cbc361
SHA1 3a05da5275b572b49b156e8f5a772995e1ff8be9
SHA512 fe64c198634b4faa4677f8968dbef83bcbf02305720c90d48cc0d68a70b2c3978a6e1d3fd3fe4f082b5792409875a33149d237a984ba599e5c4e5ddc7b6ad82b
TLSH
T11BF027BB6EE72C14FDAFC3D2307224610A107DA98405AD4F542EB2C7A0B5218181ECB3
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5c5075ba85797d1266f7a902255022176fe2b40a52c9388e6003309bcd9a6995
MD5 0f1d20368f9ef9af2b4315d1903c525b
SHA1 47d83268c3d23e00d058e590860411001674e809
SHA512 38d7f197160e5c7182a0a8a7d660b5f7d6934e34fd3b139de861d379dfad1879685d58f1e75d855c85e640de5bfb526c259c124ebe7cd63b9ac7301d3400a85c
SSDEEP 384:nziF9CcmyWCs3sNE8TUNTUlImkrzoNmqEGwBfgVWnVAlwQb17VQdvQ6whkP+lFYL:eFccps3XwglrmVyVAv5wQ6whkoFYS/wj
TLSH
T135C25B32E898DDBBECE64BD6B74A3647DEE011A3C5888ED4DAD91E0D00DB19D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 da5b060774e030961aabbc6b82d6aa14485efa9e2a3594f96ab1a0e0f06259a7
MD5 92667c4c8b1a0974fe48d1769f1d5ff4
SHA1 e84fbf9adcc89013c312874cb8aed913ab54f1d6
SHA512 98852b98808ec7d60dbed118d70dd805e3d32f4882e6c3415a922f739fec699a0f3ff2b1f7588c35d30dbbe267abd4274226b890b5da4633025b502d89312702
SSDEEP 384:nm6iF9CcmyWCs3sNS8TUNTUlImkrzoNmfFvwBfgVWnVAlwQb17AQ1o6JhkP+lFYL:mxFccps3twglXNVyVAv8Q1NhkoFYS/wj
TLSH
T1A3B24B36EC58D9BBECE64F8AB74E7B07DEE001A7869859D4DAD91E0D00C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lapismixtwo.exe

Path C:\Users\Admin\AppData\Local\Temp\lapismixtwo.exe
Size 805KB
SHA256 e9c6dda67b1da1be30f8b0d4c7ff329c6b9831ae2c413742bbe59cc66690a630
MD5 3cc6072eca86948127764f87d84baa85
SHA1 1d0bf06fdc2505d6947d4b2825e888ab5148b68b
SHA512 be3e6d80126055fb87b124d292eeb00a6fbef93b82573f8ea070d57414d0ff22761af54f3f47f914c49e6c7bb67d51069405133ea0286a5af49a08337280cb8a
SSDEEP 12288:eKqXmsruZ1B3Stb8l8YCXa06b3Xwd4XZhOfOanhVEPVwjo47aUyqIFk:e9RSdCd8K7Gbnwd4XZ0fOi3ENKn7aQ
TLSH
T12B059E22A1E04837C1A35A3D8D2B9778A92BBE7139245D866BE43C4C8F37E513935377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ECtLj0kXhQzF0.exe

Path C:\Users\Admin\AppData\Roaming\7uGMei8R\ECtLj0kXhQzF0.exe
Size 1.7MB
SHA256 905048266f359367fea147487dce73f4f7c40c631fa9e0dffc74cdebc787db33
MD5 ffd71bf93f26ad93aaa454fbb6c77fe5
SHA1 8d432ac2b8d92bd9eab04186340536c155888b00
SHA512 6f489b7e3eccde559f4d7001e9edb90beb20448d44c5ffff47e2cee8a4aa1dce018369e22e0ae1810206dfdd3b03a9f6cf319c3fbe7c603ce37219a663d6ee2d
SSDEEP 49152:NvIuccRY01hY6U/M7eAFPoDW7F1L57kyASC1:NvCy1hYx/MKSwDW3L1kbSs
TLSH
T16985CF8951BB8198E7C57434B7E56A0DCD29BEDE1CA19DDFBE13302029A975108FC32B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1QJbLO5Q7aS.exe

Path C:\Users\Admin\AppData\Roaming\YK7E0r\1QJbLO5Q7aS.exe
Size 10KB
SHA256 aba14a64c2427ab54db44a605d5b408d57e713b3a4d26a226b657c3f9fb12928
MD5 4bd321ac2163c30f557e5afcd182748d
SHA1 9aaa9c8c49fa50c7a8cbf55ffda6fdce704fec6f
SHA512 fa15e6f384b28f81292642e7a2ea9bb2e698dd402407a3f35e3220ccd5b4d7b9b6e8e0932015a15d1f4943e5a6101b1e4715002ef0417c06447b00489336e8a6
SSDEEP 192:i6fTPULD5G7eEyzMlVnhfyGjcuXl0mRiZSJWXFa4n:i6fTMLD5G7WgVn8Gj5XlQMJ8g
TLSH
T10F221BC4A35561EAD54D033FC522CD23E596F10582A1EABF90B4D2B79F42B436A3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dBecEGdik.exe

Path C:\Users\Admin\AppData\Roaming\pGSucDO\dBecEGdik.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-695-0x00007FF6C97C0000-0x00007FF6C97CC000-memory.dmp

Download

memory/1340-718-0x00007FF6239F0000-0x00007FF6239FC000-memory.dmp

Download

memory/2124-403-0x0000000000AE0000-0x0000000000B0F000-memory.dmp

Download

memory/2124-407-0x0000000000AE0000-0x0000000000B0F000-memory.dmp

Download

memory/2124-406-0x0000000000AE0000-0x0000000000B0F000-memory.dmp

Download

memory/2124-405-0x0000000000AE0000-0x0000000000B0F000-memory.dmp

Download

memory/2124-404-0x0000000000AE0000-0x0000000000B0F000-memory.dmp

Download

memory/2124-410-0x0000000000AE0000-0x0000000000B0F000-memory.dmp

Download

memory/2124-402-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/2124-688-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/2164-793-0x00007FF63AE90000-0x00007FF63AE9C000-memory.dmp

Download

memory/3224-708-0x00007FF723300000-0x00007FF72330C000-memory.dmp

Download

memory/3532-762-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-748-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-741-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-745-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-747-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-751-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-755-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-742-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-743-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-744-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-746-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-749-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-750-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-752-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-753-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-760-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-724-0x0000000001340000-0x0000000001341000-memory.dmp

Download

memory/3532-725-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-736-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-737-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-739-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-735-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-734-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-738-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-729-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-740-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-756-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-754-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-761-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3532-759-0x00000000016D0000-0x0000000001A70000-memory.dmp

Download

memory/3624-788-0x00007FF66B8C0000-0x00007FF66B8CC000-memory.dmp

Download

memory/3656-713-0x00007FF6AA060000-0x00007FF6AA06C000-memory.dmp

Download

memory/4728-698-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-684-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-30-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-27-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-683-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-681-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-29-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-696-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-697-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-685-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-420-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4728-670-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4864-401-0x0000000004CF0000-0x0000000004D1B000-memory.dmp

Download

memory/4864-400-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/4864-28-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4864-408-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4952-703-0x00007FF6CF030000-0x00007FF6CF03C000-memory.dmp

Download