Overview

overview

10

Static

static

3

2025-03-07...er.exe

windows7-x64

7

2025-03-07...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2025, 21:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber.exe

  • Size

    5.9MB

  • MD5

    ae78b25357fe235d510e80fdceb66236

  • SHA1

    94f3276f301e2b58dea48f6ea7bc1c01d6213e30

  • SHA256

    03e976dfc44285e2a1e2146fbc2e0d646c23d79d2897805489554cea45ebcf53

  • SHA512

    dc9439e4108ae987b6db142191708aa20182a30d7cc7cc08beb83618088f8e5bea0d10552339abdde0c4f8785d9acd8f42541ed7660a6f8e21f072cf1711cbb5

  • SSDEEP

    98304:e35z7PcMH5vfEyTLMetCLigFmdiwBYwAzWgcdJR30vjDwHujR/zWjFvnaNolt2sX:eJPhH5+LBmAwBYwAzOdJR3hHuV/zgFvT

Score
10/10
meduzaadwarecredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza
  • Meduza Stealer payload 1 IoCs
  • Meduza family
    meduza
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 40 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 4 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 39 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3236
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:3360
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2192
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2552
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3496
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2748
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4412
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2468
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3052
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:5096
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4112
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2844
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1128
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1224
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4912
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3852
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2748
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4876
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4548
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3784
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5028
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2564
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4336
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2860
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5412
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
          2⤵
          • Modifies data under HKEY_USERS
          PID:5452
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
        1⤵
        • Executes dropped EXE
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEQ4MjkwQzgtN0UyNS00REU0LTgxQkYtNTA4NEYxNkQ5QjVCfSIgdXNlcmlkPSJ7QjMzQkI4NTgtNjRFNC00MkQ0LTk0NzktNjkxNEQ3NEMzRjE4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Q0ZDQjJEQUEtNkQ2Ni00RTBCLUJDMDQtQ0RBRTBBQkVGODFDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxOCIgaW5zdGFsbGRhdGV0aW1lPSIxNzM5ODA1NTM3IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODQyNzgxMDYyODkwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTI3MDExOTYzOSIvPjwvYXBwPjwvcmVxdWVzdD4
          2⤵
          • Executes dropped EXE
          • Checks system information in the registry
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:3220
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\MicrosoftEdge_X64_133.0.3065.92.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\MicrosoftEdge_X64_133.0.3065.92.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5976
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\MicrosoftEdge_X64_133.0.3065.92.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
            3⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Installs/modifies Browser Helper Object
            • Drops file in Program Files directory
            • Modifies Internet Explorer settings
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:5836
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff61d3d7a68,0x7ff61d3d7a74,0x7ff61d3d7a80
              4⤵
              • Executes dropped EXE
              PID:376
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
              4⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2380
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C1CC4E16-307C-4972-BEB5-804FB9AD55A0}\EDGEMITMP_1186A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff61d3d7a68,0x7ff61d3d7a74,0x7ff61d3d7a80
                5⤵
                • Executes dropped EXE
                PID:4324
            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --msedge --channel=stable --delete-old-versions --system-level --verbose-logging
              4⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6fff77a68,0x7ff6fff77a74,0x7ff6fff77a80
                5⤵
                • Executes dropped EXE
                PID:4496
            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
              4⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1304
              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6fff77a68,0x7ff6fff77a74,0x7ff6fff77a80
                5⤵
                • Executes dropped EXE
                PID:1672
            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1496
              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6fff77a68,0x7ff6fff77a74,0x7ff6fff77a80
                5⤵
                • Executes dropped EXE
                PID:2472
            • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5104
              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6fff77a68,0x7ff6fff77a74,0x7ff6fff77a80
                5⤵
                • Executes dropped EXE
                PID:1836
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
        1⤵
          PID:3908
        • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
          "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
          1⤵
            PID:2852
          • C:\Windows\system32\wwahost.exe
            "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3040

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Browser Extensions

          1
          T1176

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          4
          T1112

          Credential Access

          Credentials from Password Stores

          2
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Windows Credential Manager

          1
          T1555.004

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.92\Installer\setup.exe
            Filesize

            6.8MB

            MD5

            5d0a70268c7716c1a634d240b8f29b7f

            SHA1

            999e449f13652475104cdc25b0d4150f456b3d8e

            SHA256

            27547bf9c2e49459c7609a976cbe033aa09ee53ddb11e0fb55bafcc1668133e3

            SHA512

            643c662ce79ead548a63f1930b127408fbcbe7fe0f6ca44012e144ea4a2d1e66c6f71ec55d18ce97ff6f1b764f7210960af3a5ae30d41eaf80514f3c548ca9cd

            Download Submit

          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            Filesize

            758KB

            MD5

            505dc2187ec156b34dc83cfda457aefb

            SHA1

            db00f07922eded77d0943663eaefe95e643791f7

            SHA256

            49a50593d6800bdce886abcb5bfe17c9d220a9ef38eecbfdc07ee1d934bc1215

            SHA512

            aa6385cafa14ff62887d53aa41364378151d4b14bd9be53e6066c408d92c80a2387b2a9b5ff6116c5ed82e2439fce76693ed4ea02951b14475eccd07b1d142d1

            Download Submit

          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            Filesize

            2.1MB

            MD5

            a6aa14f19ec3f77078c30959c574f673

            SHA1

            0694c3fd55e5f248899d1034babccec52b5dee1b

            SHA256

            37a5b10ca584233dd5260887bbb426f38a9b9fec34da193058817474c5dcadfa

            SHA512

            14b339dedf05c7956d02f8dee68eb025f518a83e378a9d6871946f39ae8a0ec7a0ff2ec1561f17050a13d8fc354ee3578f7df78ebf139ae69c2ee9a2ff6f470d

            Download Submit

          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            Filesize

            789KB

            MD5

            0c94f13ef56448dbaeb774ea4e704907

            SHA1

            0b7fe400d3623f13544d245f5c046709f17160d0

            SHA256

            ba137f8dcb31102803b6d63b6a84c4245103d139e1d5a2b888e9de47176d02e5

            SHA512

            7b66c92a2569217b75db8566a22fbb74fc4122284ec73977fc5846871181d638806e20f0203c3ab29d4dfe093cab6b8bbb5185a9adf428453bd1f46bb49f5c3a

            Download Submit

          • C:\Program Files\7-Zip\7z.exe
            Filesize

            1.1MB

            MD5

            fd5f0a7064a5ccb2e77400fd023d3d65

            SHA1

            20224fce9528e556f11d57544d585aacba47d00f

            SHA256

            3c609a2215adac3091a1e666b33c9b200fe3549ea215400719d6d70e38db0500

            SHA512

            bbc3f9ec8aa835f3bd41f564bffc8b0d54030e925c6921d44b3f5598434dab71ce5515b40492c425f42d99127702011875640d6c7c619ad24d3cf391f9dbe6fe

            Download Submit

          • C:\Program Files\7-Zip\7zFM.exe
            Filesize

            1.5MB

            MD5

            fc43d733173a5f222666eeba63909339

            SHA1

            fd2f72ea88fab3518322f8a7d382bd0931722668

            SHA256

            f6600f033008bc0ddb57066df901b8380feaa5f2b62802e45f47087125d3bc0e

            SHA512

            8ab785bb0e9037920b682a7aeaf8b22634cf8f87409884648fe0bb7c399e149c88f4c1084f2948846e9aed5ba8bb19e1fbc7554c53299e2df0ce3ee753eff710

            Download Submit

          • C:\Program Files\7-Zip\7zG.exe
            Filesize

            1.2MB

            MD5

            055c726ef212677465455785184b0813

            SHA1

            f1ef4834111b6103957d907a721ae07d06fa1210

            SHA256

            ebb58c514c1b1cddb3ab9dffedac783a2bf90d0e5cf93b7aca68383b2ea3f090

            SHA512

            2520e67979ab7b389e5b4b888c7b87a84ca28360befcd280461cf644bba07e0dc1099f1469bb3066bdb290bb2ee2c83a80749c84294bec22c2e073ee1a62f45e

            Download Submit

          • C:\Program Files\7-Zip\Uninstall.exe
            Filesize

            582KB

            MD5

            40cbc2d61e2595e31b2ec98d77e8b463

            SHA1

            d08dc133f1b56238297448a2cc874c8294393dc0

            SHA256

            079942ca913efbd1b8c5efbe166b2b71e92449400cedb6ffc12937711fa746da

            SHA512

            098d41218f7294843355e599d633fc369f60d3212030198364d16e5c0dfd56755355588040c2c481cb81a10092423ccdf001fef3372c5fd34284276047f19918

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            Filesize

            840KB

            MD5

            cfaf20539fccc044ee0b55b39f8465b3

            SHA1

            c865c3e34ad55bb0f36e7fc8663afe8ea22c9b50

            SHA256

            e85f6d3b113d5705c533d50c5f120e48d9e9f71ff2473281587b145eb427a91a

            SHA512

            f0fdc5392cb148f512a4df8c78762ee5efc98569bba6400b336dbe40e2321b1e7be7abe4d64748b1f83b1ca0dd1732ad99e25409ede310054838b71e17ac3ca7

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            Filesize

            4.6MB

            MD5

            4e798a9850f29f98395e0cdfdfd06459

            SHA1

            e0fe5efbbe4ef68086d9ef75d8b94bfe82b806d8

            SHA256

            86f34dc82d844b39e186c2760b50780fda0b3867a67dcce7f92eef71fadb85b0

            SHA512

            b34719d856f91d8079e11fe44de0e38ee8b292b54d3bcf218a5801188cdc6b9f57f43e3df16e83dbd2c9890d87d81ac4524bb99c829d5097e03f423e9604c333

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            Filesize

            910KB

            MD5

            109c07cc11d973d3ee1a85d55c61ad82

            SHA1

            d078d0c90627e515b6271463af2e6fe7f7363926

            SHA256

            f657f6eae6c58f59aad7ac9110b660d552772dd3071d1533ad7bd4c55c429637

            SHA512

            776f1b6f10b27799e4ccecc3c6c685f7c7e1a32ca9f72c0ef5f30dd62dcf7ab86851070863452edfd99a2e2b4d321cffa848a9e0791a1b7cc1c6c5ae0f5d04fa

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            Filesize

            24.0MB

            MD5

            a6ad046402e0575f2e471e4a251e1f22

            SHA1

            e7b79b0acf41af1cd24d6e218dba21445a03c327

            SHA256

            0d1ab588f828603c57d69e7fb8a3052dff10ed27ea7c6b74b923c3252970da97

            SHA512

            1bf92af5db0251d6d2b1b9e8ae91642d14e402e236401091d616fd0502d8c41b2a939c7e4f42ec4f48c19891108ad63d606606b8c0a1a97eeda86183c22d49b0

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            Filesize

            2.7MB

            MD5

            0dfdde88a7e789f9220b7751a1b698f6

            SHA1

            632df73ef3b827b858651bc0a9f9d2bbeb3dc8e3

            SHA256

            c21647dd5a7eb26e6058d2964aea726d3de83451dbdc7138f90f97ebc631f4a9

            SHA512

            707aaffa5b595bf88733207f5715b2275a8ed6d6e047cdf034b80cf0e896cce740e154491c8a8f3012bea58cd71b608ec0eeddb6cfe7877543ea718ac185e43f

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            Filesize

            1.1MB

            MD5

            45a5187e776d578ab67787bc0653cbec

            SHA1

            f41ab3daaca2b51be5f5985c274d1346da098408

            SHA256

            5fee91bd12eb93864a7ac0813e7ab0f68c745c88085c05fcd136c38ec197d0b6

            SHA512

            c61bc5990f7dddadcbd9fa1c30439c9ab8c223ca8e5e913a6c01854b0dba57349994a142e727035a0111ab9465ca41bee47b09c25b713159267c825f2f703b67

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            Filesize

            805KB

            MD5

            1fec9f506f1d656c2ab48d04f5256761

            SHA1

            41be608eb191e1d17c624e40db14bebc8d2ace97

            SHA256

            e0905e0ffae3555dae715d113ebf46529bcd8a9445c5c8fb9845edad9e28f63d

            SHA512

            45b7af74a8758f20263544d8efb61fa26de86eac55b7bcb81dfac096d9dfa203afdb24de51ffca3b0f9ffed81d203299422bf7bc13eb3ee10b394dfc205d2dfb

            Download Submit

          • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            Filesize

            656KB

            MD5

            5f565ff5478107acfdec6a837420c0fc

            SHA1

            3184444b148d090bac21b297b860ce904b94664b

            SHA256

            6c19eab14eae664e77f76df2516023110fe764ab67eba625b9be2f68845de69d

            SHA512

            083787a01f5720eb6b6241b5a34e0b869872ae7211ac1c45087f58fece7ec264f1761bffbd91882d422f0e40ee4baaf8409b75f06552dc6ec48d3e495e90140b

            Download Submit

          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
            Filesize

            4.6MB

            MD5

            968806b41b1d2bd806a5eca41f7e1040

            SHA1

            f1f6f16ca093485171fec5de8ee0c951469d2f16

            SHA256

            2b9710494ffc7a8d714a5b0d3b1ced7a2c03808c449bf34dcfb6b03ffc1b61ba

            SHA512

            16e2e941f4bf16260ef253268e48c8fad8831a3497c206a7cd70ce6ead0c760f7f2c78445a1ec739f2adebd5d75bc147b09870bcd755ae95b84742b48480f5b8

            Download Submit

          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
            Filesize

            4.6MB

            MD5

            46bbb7fa5ad542979b4e1c82e2f99fed

            SHA1

            ead6ec449c73568c539218398f817a4ff9dcfaec

            SHA256

            7a64ce03d31f7828318f4c1d321514f1d58ac216e2cd8524dd17a484c6ca1d38

            SHA512

            0e8d671fd4bff29cd7c3482cdab2fd7e32ea735484fe1611814f146977a1f81694625f6880146dc584fae995da088c7afc821b07caae39fe3dad8574253bd75b

            Download Submit

          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
            Filesize

            1.9MB

            MD5

            71d7c9ccd90943fe5f7d4afcbcb56110

            SHA1

            1a97cc579724f54e8d49dc14e7a6c9c2a6c112c5

            SHA256

            81a3020c95c05c0ec361340a14a3417faee15b319c822787af98328f5a7fc0cd

            SHA512

            54bb3e658c8514fe975f968642f354452986a1c7c28ceba4bec959cb81f83c583af01fd26cec740a5027c7219d95a9432868d3d9745e42f3f29588808919adbd

            Download Submit

          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
            Filesize

            2.1MB

            MD5

            f53af9216931152cbe64042c921a80d7

            SHA1

            168248eb38be81fd4e2b862e2440a84f390f6866

            SHA256

            1074d3e8ed4aaa578fc9cb857230d94cab56e019255aa7b3a3326f3c9cc92ae4

            SHA512

            3d1bd05c8e0f3c4256122ee99ef367d6f8de0eb1d6565d8035bd0aa46ed328422dd9c776acbacdcb00bf2bd19d6d8a68f4b5a7fa0f6d347e2b00d84251a08ebd

            Download Submit

          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
            Filesize

            1.8MB

            MD5

            18fc4d01178e73b85626adaa9d9abe38

            SHA1

            75efe15cbe23ca9a0fdb4af139214fe4b5844160

            SHA256

            e970827b801cb1a4f3990b43c2db29530426ed2d9d1a9c4cf10d817e87133ebb

            SHA512

            d021d4d7725f937a342e4aa185dfc404021506ba207745bd0a5cc96279787737f54527ecfe17cfdbb26a125ee28a57c94bc1aadacfe76fa9f78b91d218ef2e74

            Download Submit

          • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            Filesize

            1.6MB

            MD5

            d05ddba6a54c78d211d6d6140be1d924

            SHA1

            bad7ff6d32ef43df7442882694b1bb5e75fd5b10

            SHA256

            a1160147d3c00ff8494332cc49dc94898c88d2bdf168cb9c9a7751ee51c3c249

            SHA512

            4b4d27003e4cca4189900204bc381fd875a73031ec3d33da17276ad63913b540ef2ad4c0306b052df9bbbbb95a4569e3e3a0d0ecb3b3d4cd2cdff1ba15df6545

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            Filesize

            581KB

            MD5

            77cb97194a5fe26df74409e7453c5e9f

            SHA1

            b4d679c4e994590e966d530495a6f8161674fa84

            SHA256

            5a638c966a1f7fa2cf201ae8ccf4a45039ff5e10ddd57c47414cc3741709c6a0

            SHA512

            5e752ed7d68fb855131ef3ea41ce9e5bf03ca7048175f6287fb90d14ec7b6be7e068989558132cea90be8d049113ef79a3cab42bf861d2e1d7cc65e3e67c7566

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            Filesize

            581KB

            MD5

            6bb86ec542e806ed62f268a9139263b0

            SHA1

            66d5b54d5ddfeda952d181175e6449fad0551551

            SHA256

            23bfb0ac994adc093cfaa483b3aef0d3c06a119e0816465336850b5bf7174239

            SHA512

            5a3f46136c20bb2caa946495ee8682d29fcd1a879d97ed0090a2085eebe45e249447d3b5e1c6fd229b3bb51252420d9842014f24ab610ab5ab0558e71cc465f2

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            Filesize

            581KB

            MD5

            61ad4644e7eba8c3780e2afdb97d829f

            SHA1

            e1a4fc48e329a337602a9ab19b46f3845bcdf03b

            SHA256

            7fcbe3614e300eaf15675db769fd4c20372a5b1352df0b64bfade6874eb148d9

            SHA512

            0347ee74b9adeaf670633e15e71490fdd0b8140bb1eb4bada2ac1b7f0101f0e7bf67ff6abb2ae4edce74930fee7aa7b47156b92bc63c0968debde7f845c1fdd4

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            Filesize

            601KB

            MD5

            8696799d4ec3e74ccb1c49b30412b7b5

            SHA1

            fbf1d64d123a7396decfa02f862c73583a9fd32b

            SHA256

            204ee8a94a7638ce1268a300acca759a7b308af5c84c6668013c1d7fdb0f347e

            SHA512

            1a05a049d044de458550b813e6e587943e5298fb2732c81534c10c2ee0c09197148f23ba35638403f237bd0bc56b7192b154a6c53f6570776d4c41b2606e1a9e

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\jar.exe
            Filesize

            581KB

            MD5

            277610b6630d2cbc7c3ed7b6b4321e6a

            SHA1

            eb68c54e83538c43a695a983114a631332a04477

            SHA256

            05f7447270d0086d14e9332446f751f24300bfd98329569661a0339371be5785

            SHA512

            681a3e156e3c5e24092f4d5478ab882d65ca8e21c2f19884208eacc64439bcc02045b56d961a3e702842d95f9ffa0525a3349fd8746f6f8f37cd682acf61845b

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            Filesize

            581KB

            MD5

            565e4c5b82c0be2a8aa03a9a4763b920

            SHA1

            77b2cced96909e0bee519e3537f51b46bbacc660

            SHA256

            7bad03620618dc39284b53319e63139fc39d5da810b6a5f37a92b92227fb7259

            SHA512

            aad82f47b7f02630ecca6b78608a265e09980b3820ef128700272ebc5b049fc970bcb532616a5308355a90fd72d94a48ab9ca262f90c4f194d87fdecbd179468

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            Filesize

            581KB

            MD5

            0989de4f05a13df01fa2a40c5ed87cb2

            SHA1

            a51ee36dad098c95f0b50438b5a0e5f3e44b8f32

            SHA256

            28a2f35fbb91e6932d61420516be5dc41d9e38a9c23a04b37c055f97822607fb

            SHA512

            60dc1a26eda50a126199825d165ac6f0ee0b535daeaf60b3926e8e079e49a4f275f11d045aa531cdd0af1de9a6d23cf2e3b11a3a10f6881bb22adf686b3a9704

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\java.exe
            Filesize

            841KB

            MD5

            4758e35f43f22d79b6b64730881c7753

            SHA1

            eea4caf98a4a1f463b4ecd3a886a042862a5d109

            SHA256

            f03490248f88775308ffaed4e464f176758bbd9f4459b377004ddb0665606399

            SHA512

            7d357fdd4c278d1ce3c5c28f0d8d473d36205f656a6cc42898cef51808cd8eaf9455d16d2ab0782dd16b0775baede9a56d4c597be31291eab30d3c4969d3c7dd

            Download Submit

          • C:\Program Files\Java\jdk-1.8\bin\javac.exe
            Filesize

            581KB

            MD5

            287c93dfd88f810bccd2b0efa20304a0

            SHA1

            cc9d4e1feef697b58b739a836fc3fed0b26c1df6

            SHA256

            bbfd248790213929f6bc0b36867d6e097f55c989f1162c454c67c9964d3f8b59

            SHA512

            b0b6c88cc08c2b4faf0e0f9818a3a8d5f364a8fa5fffbe66b2a854e55f8987fa742e51444940ddccc17d37d8bf03fa3154660fb466eb010774edeb0d6561191e

            Download Submit

          • C:\Program Files\Windows Media Player\wmpnetwk.exe
            Filesize

            1.5MB

            MD5

            e73d2381387c0c6e4a9b643d6a8b64d5

            SHA1

            15a8ae7f333e8a1f2df394b465095714b08c338e

            SHA256

            5361ee3c9d7c31201b47ab240fd36789b34e170f392989d6292cc674d3c65556

            SHA512

            41e73a01af8d33ba94aa2985a516fb0d68592b8fc8a08b3fa0a376171314d37252dac167e8c9fabccb8bbe2cd72b3e6b1e232ccf9da40ffacbe9f036316685ba

            Download Submit

          • C:\Program Files\dotnet\dotnet.exe
            Filesize

            701KB

            MD5

            a5dcd3ed3fd82c28f222f3384c376b68

            SHA1

            bd8474c0af3cbda1dc6f84a7afc4f859fcd33b04

            SHA256

            366bccb23dccb6ab14c52a5e04c2c6cc472168daaff51a8dc9f45c8d6a55decc

            SHA512

            03b6ee43811dd44327891f48970714becf783a4eb1f5c6aac778d4f311c873029b4428876eea3759499190476aa2906b592c04074841776566dc9171628d2048

            Download Submit

          • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
            Filesize

            347KB

            MD5

            84a3c1b61f11d26d83d5df33ac3c59c6

            SHA1

            0b2efe694a93bd0692a573fde9c85f3e813e0676

            SHA256

            4a251a3e13086e0e181c493d1f6b3aa36f646b433e3e9b858a709d2e056e0944

            SHA512

            e2dbc7a1578b6a4058f33696a229dbc9036a840197ea9c7ed5ff355bf69350893e4024738831c94674902536ea3f2a30fcf08e28c4796cb60130ac8ebb8364ee

            Download Submit

          • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
            Filesize

            343KB

            MD5

            fd1ce3cd0bf288524b813e7c99d5696c

            SHA1

            74d1f7a293ac8b12803e1011ec3a8e088bee455f

            SHA256

            2d3d81cf1ddae9205abdf350f2c46cc7ba300b9195ba2f79dbfff9e2779e4905

            SHA512

            873bc33f4947851d995d0900af9cad4f8036c8e6a679c37f34684471698e033dbcb207dff6e629d53eb08ff4345353df122d9d4c2c081568b176a13e464921f0

            Download Submit

          • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp
            Filesize

            8KB

            MD5

            2865ce1674f875c96bc861c7da999a50

            SHA1

            adae0a8352e86ead68e2cbb4eed4b5519c3dc0d0

            SHA256

            0a455f4f7815d3b3d50fa84b43474adc926e77a9c4dba3af8a9a9e396ce3e7d0

            SHA512

            996f67349bcfda5bd15c44787b1b653a9d2b9cca19bff594a07f432f9e82841d970f43f86531ba9ba067fc2917c8f06829e9fd6caafc64df91bebf32609f494e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\Agent-20250307T210032.log
            Filesize

            649B

            MD5

            73cc7ffeb24d22d8b6a1ae644e57fef2

            SHA1

            7c6ad95c85cb1446aa35f019f8461eced154e081

            SHA256

            15cae9740b53cb6529c412b23fdcc0416abe64d2c9640ee5014e955d6758c642

            SHA512

            c4954b07e2f61dfb41b5b9c00451d6540a9384ea0c13ef92b7693a26b121054afff048c00b3565c1cf1d44692b49d2b12565aa35da88d03b0e69a5cd307f98f4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\AgentErrors-20250307T210032.log
            Filesize

            6KB

            MD5

            f270c2931085d0f711fd2d6b89457615

            SHA1

            a6e957d73eb1d3cc8fe04047b791d15544dd2c84

            SHA256

            c5def58f982aebcf2136d7d888087ea864d0a6408e3ee4bd785afc70ce7cb1da

            SHA512

            fd16f19e620f71a909c459415d7169edb140e3c19440a728f8785d062e03b8d77ce4ad4ea79db98d082df8386fe94be6403df207732809318fd8ff66b5c202b5

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\Features-20250307T210032.log
            Filesize

            91B

            MD5

            686544a675459debe1f36a51c9e01075

            SHA1

            7e5b825ed734b47b4d02d2b3738cc8cae33140c5

            SHA256

            94e21ab598c3ff40ad9e091add1c8b56811f35251bb1cebcfc39ee0fb4846022

            SHA512

            c52eb9abcccec28374bba18f792728bad87ec6effe10b9492fd0b84e649c43907cbd193d35cc72daa6f82fd22a6234b522c91ffc53659c0a091052d33979350b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\Operations-20250307T210032.log
            Filesize

            290B

            MD5

            d91efa1ed660d4ec31d7e054414fe43e

            SHA1

            c528e708342ca3b4c713afaafec6d738e5140f62

            SHA256

            6371e70b0d9bad79318d1dea868298a03f77914a97343cd947b4ffde6c844fff

            SHA512

            9f3525129978d59ac543ddb14e3805ddbc3f0d0cc96c1e80c2b8854d2368da7a07572683ed0e973aa17026e4191c51a0fe6f057bf085e0a65f72eb158ddeb205

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\Telemetry-MessageStats-20250307T210032.log
            Filesize

            635B

            MD5

            4455113ce4215dd4a9233b924c1f7f3d

            SHA1

            a7df11466b60e10eb11ed0af300df3c4c9772c37

            SHA256

            71e69cdbc3b997c16c4ca95b5c44b3fdf26081dc5969bd637860a15e6471b8d4

            SHA512

            a204cafc9b328340b1a10a5a266497bc9ae68d1af023503c8484989412d3af99b5f929d758f80d4e560672870ae32e654c733c4c7f83a2f789d1e80c08d526a6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\Telemetry-TELE-20250307T210032.log
            Filesize

            3KB

            MD5

            d0d4daa02e1e9042d95cea0854473254

            SHA1

            7f05eef1f45d2f29509801354d5b4eef1ffe8b9c

            SHA256

            9fd564a3ee8bd6ebd679236d7046eb2c36fb771dce49dbd02448496e1ee938ba

            SHA512

            f90efebb811477ec5f4cf9cf095bdbb5e90fa29973ccffd537edd68034131b2f46ee532f323a4a37000c79fa0fdc696f40eb73bbf80c458427bd142328b2e1a0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\Telemetry-TELE-20250307T210032.log
            Filesize

            4KB

            MD5

            e73c74e3015fea2f0b5f1133421d20dc

            SHA1

            6c06a684b2fc210ddee2683e369bb08331edaf25

            SHA256

            138dad7d11ee5b8242a36c7d39455594d39c6b4b2a4b0df6b53c23a442bb24d0

            SHA512

            c8a50c87bd157c6942875164a0289a5e104e02f78747bfa347f6cfac1537e4bda1298e7a7ec39280df14eb61e7913e6c803c8665e11092554f0029a5687dbeb9

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Logs\Version-20250307T210032.log
            Filesize

            157B

            MD5

            aa68b5636645073019084795ee1bd3a4

            SHA1

            b4a66531f1b1adafeba6942820c549631bf0387e

            SHA256

            848cc10671db809891062eca57e2dc6134078941cc87295c873b3d44299a91fb

            SHA512

            0d656c2b2339e799fefe68fd812b497f6e6509dee5d0a1ab8eabca24eed19a343167f0db69fd4845357b59831a7637e503a43d0ab22f3502420e7fc7a5b7dec3

            Download Submit

          • C:\Users\Admin\AppData\Local\data\cache\2f\91\2f916817de49cc9943366ec2a13cd67f
            Filesize

            5KB

            MD5

            2f916817de49cc9943366ec2a13cd67f

            SHA1

            d5949ac40ce8273f9458211382d0cacd563cba4a

            SHA256

            b23a0601350b3ef4462321d0b23b7008cf5f6200df7431fc8cb36cdf49578373

            SHA512

            61c14784c27489cc5226a2a21eac4b259ba143583e5e75d8db9e56f39e22016e388b2307a2ac6cf7ce95641ac369b151f329724f53663d6fba003bbdb1852de5

            Download Submit

          • C:\Users\Admin\AppData\Local\product.db
            Filesize

            186B

            MD5

            8924afde4e48ca45eb78c9db8b38e9d2

            SHA1

            85203b9f9aa548bfef83486faff109b8a51c89d2

            SHA256

            9cc12cd62e43218e6c14c533408ecab0fa15417f41c2a44fc5a82aa9bf1cbbb6

            SHA512

            69031b6646560e0713b9cad812d9d541f6f221fdd8f23eac206bcb6bdb072e442f11b92a49a72738a49a6c7675a0c72f796e6b65744ce4612b78e05e69a7a378

            Download Submit

          • C:\Users\Admin\AppData\Local\product.db.new
            Filesize

            304B

            MD5

            204eafe26cb8a9026ef7fc7a4e57831f

            SHA1

            baf43387f836843a5962bdf36fff4c5e17c72068

            SHA256

            808b4ab19bb4d6f58b6cf4532029d69258fe334f6a09dc81397056b84fe86347

            SHA512

            09fcc3b44cfd6b09cdbc7ee58cf59bf46ce50ade9a8d04c5a870b383752a005f5d018f2c27fc5e3f415e985ab16e4a1d9f8c1f26f04cabc241ae4ae1b8db193e

            Download Submit

          • C:\Windows\SysWOW64\perfhost.exe
            Filesize

            588KB

            MD5

            f4e557f078f60864e42ac552deff54e4

            SHA1

            e656ffad412e418e81ddf2eb53b4f47cb74b5179

            SHA256

            4d20d51176bc20176f57f3199039ee9097bf3d29fd3c48c10d68e078191c122d

            SHA512

            df47ec13be0dce0f3dbeed7047d5df0015f018819dcbf8997b40e15dcf51587120cc80da173dacafc8e2761bbead611e28670c476534e5785ba07e24c9adb175

            Download Submit

          • C:\Windows\System32\AgentService.exe
            Filesize

            1.7MB

            MD5

            e2814a07205a5b54f0acbd6b20204554

            SHA1

            500b4ccce83f00a6bd6fbed230e26c02061c5475

            SHA256

            ed2d01055580cf5e66851193945871ac2020fc1999bd3d1f5dbc85bb0a89fbe3

            SHA512

            8a2138ef0237c0a6065b317576c9488808f32a5c513793db1bd409fc55d53d36f4c2cbffa421fb1c9dd09482db67dda4ef3083293be250ed0512c42b1ad705c2

            Download Submit

          • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            Filesize

            659KB

            MD5

            f6b92ac5d2f735b2700c95d7164696e6

            SHA1

            a6ea63415969940ecd1e90bcf88ae4a6638fcd92

            SHA256

            e943645e44893b721ea68c492034c156d6a245aa1d57c995efc502bffcd84ca0

            SHA512

            c687eb84ca6841b4510bb0b53af261c50aec6911419d2799dd94fbea23f48b3bea5888dd12f4477a8aada52d86b6a5fac39126063a1007a41c432608d05da664

            Download Submit

          • C:\Windows\System32\FXSSVC.exe
            Filesize

            1.2MB

            MD5

            5e36e7d7b07638fb1e04ceffb034291e

            SHA1

            bed460bd6585cbf58e35b7aacddd64551a6cb09e

            SHA256

            7933d5b1c0b6fab46cf7891311bc6cb6b0108be8dd570d933f46596bfd956bf3

            SHA512

            d7dbfd06087f73ebd8d39e705eb7a0bd05226910e2aa1fd6f181c7d632db2a26ef27e47de27eba5ea5b1f60cb7115660009a8acaa406e6ac0e8fed652d508f31

            Download Submit

          • C:\Windows\System32\Locator.exe
            Filesize

            578KB

            MD5

            b9fa1ff0d71a1fc8c4e9c83c31a0ee4c

            SHA1

            ac06d4db73b6f20b5077bf5bc4c99ed9fb71a069

            SHA256

            adc9947ddf3886212363144c877c5d6305328cf771e2467f134f480c4cac3926

            SHA512

            09d519e2a3c3023409003e312a18be533e0d4584f7b114557522b4a2a5a36dedd2577d4944855287a685b46efcec3248eba2286fbdeaf3150128ae44151e41c0

            Download Submit

          • C:\Windows\System32\OpenSSH\ssh-agent.exe
            Filesize

            940KB

            MD5

            bd1f91d8ce5a3a987572686178f11b24

            SHA1

            ada8f0a65672050979958eaf166188201a4ab1e3

            SHA256

            0e901b490329858ecefcb3efe3006813f3fc19e206f7c19bdd34ed0872c87e1c

            SHA512

            a70e3f707e2b57c9501a1d7281767cbfcd630d8dd72c6857b030febb92a11e54ef54ff4c19cbbd87ea770c53e508085b80098907d4f867a0a7d21cb305ba0eda

            Download Submit

          • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            Filesize

            671KB

            MD5

            384c8ed3f595108c535b12c5329deb27

            SHA1

            f34c3084fed21ef0d430833e9d0caa601aca5031

            SHA256

            c91b79bc35867fec742b91ebe87055e8dbea0b6e83eb299771f1dd3b0a78a870

            SHA512

            725db3c3989bdeb833a6cb96c408c3c3c06859ac799d94d59ead91a44bd7eee9c5f85f87f5e39d4f62553605a75aaa5ccee232e88dc6914eb34b7e03089e1e78

            Download Submit

          • C:\Windows\System32\SearchIndexer.exe
            Filesize

            1.4MB

            MD5

            2b9540af54e5ee7f97f5c5586504f506

            SHA1

            cd49394b327d9d15832a232f8fa88ebd46031e39

            SHA256

            a7e872d833ab7447a284d11014ff921d73be88c7760dcfd515e3c87e8d7d7cee

            SHA512

            27b4e90c2bed676b8f25eddf79420d8aca619e8c32eef8076fe1a47c515dc72e9bea735748f4762dc41ed06f6eba9cf148e7e57b29a3183170212837392b9908

            Download Submit

          • C:\Windows\System32\SensorDataService.exe
            Filesize

            1.8MB

            MD5

            665ebbd5f053f0c211b3b352c04dcae7

            SHA1

            222ce260093b688b509a1728ed5f7596a0be7b44

            SHA256

            8bdd2213294a88455078add3cb831c6a0bb3d38c20a66c87d4c28fb1be9aa8fe

            SHA512

            2f463e794e5cdd5ee140f7fd2b8feb9728424382c2f157626ea7f4e843d0b653a3615e093e7198be8da35125cc66f648e2b905dd9f0a5030a6e9da280afcfdb3

            Download Submit

          • C:\Windows\System32\Spectrum.exe
            Filesize

            1.4MB

            MD5

            11fdcbb168b14e09c0f039d671420900

            SHA1

            1de16f66e7834e682fc2b272c3b42c41b9795921

            SHA256

            663824f617106749abe3213b4ce42123d2fa2f341601c3f4148144799dfaaa90

            SHA512

            cc3eff19e4533735ee354fab36cfe6f07633a50adf3c405e1ac90d322f8c3873e26bc37b62f54cbb98a9ae53a65b519c9a4d89b637660429bb4eb4f2f76e1893

            Download Submit

          • C:\Windows\System32\TieringEngineService.exe
            Filesize

            885KB

            MD5

            2d3d0013d0b944b5db6d6cf78e40c75e

            SHA1

            468b5b2b873fd37a1bdabd40f32929eeb585750d

            SHA256

            f443270dd98fcd0e48f0cfe5837ed179cb81a7b044bb04f3cfff48285ef1e3cd

            SHA512

            328274c445dc737b370c0990ae49c8792a7ae3b198c97bc5fec3594ebb4355c10f7fb024adb46ded89ef72533291d931b3b9fe49e8f014a056ecc9d356bc8254

            Download Submit

          • C:\Windows\System32\VSSVC.exe
            Filesize

            2.0MB

            MD5

            522add575108387257175709f47f9c3b

            SHA1

            366cc039ad35b6b272cb39d27697e868834481d8

            SHA256

            cc48e7819595d587eac365da0c4fa1cad27ce460af1c7052a9194c8d3b52b224

            SHA512

            824633ff324911b1a44980ecbbf6add4e5dd92681d31ddd7c057ba837c90eb5f7c8ea0a07c5961c937b9e899d158ec748f055b918d41548cf6319d1edd67ec0f

            Download Submit

          • C:\Windows\System32\alg.exe
            Filesize

            661KB

            MD5

            6981518ef5c614bc0d81d359d974a2df

            SHA1

            c22e16732a127d30342fcdfeb7638e6977197b00

            SHA256

            daed0ea2bfb64ac56ba8d973b38c277f9966380be3a6a0711987d0bf7a05c217

            SHA512

            55e499e759f2998bcaf685da84d13c4a69183bc89cc52ad8c24ce72ff2f0278e0acb634ecfc8aec401058964c13740fad842661c66580f563dd4364760befc2e

            Download Submit

          • C:\Windows\System32\msdtc.exe
            Filesize

            712KB

            MD5

            5295832fe27f79f61ba5305017a65000

            SHA1

            e262be23f3cdae1b24237ecc7a80e46b31b21b98

            SHA256

            ee0108351d2a6cc2299d3de4cbe9b782f0fc225ff62b79624ef9f661d89b67e9

            SHA512

            1c184df6565aa78af84d209fe2b990349abf6c9b89e40dfe6081f1f4222c7ae43b56a9f9843770a72c3b1ec8c7705634cd0a3e868d2b165a061679c59fb1f52e

            Download Submit

          • C:\Windows\System32\snmptrap.exe
            Filesize

            584KB

            MD5

            05c1847f85db67052b29d5e8dd522be9

            SHA1

            b584879f3462b24ff49bb72b5eb77606401a6fdd

            SHA256

            ba7554d792777a0d249751afaed2599d75ddf516cc65bd9eace0a42cd7ca1c52

            SHA512

            8af7662fb0ff04e62c070836a72268fe7386a204c495c1cd2194610e8dfd66e6c6925735a5821bdd86d66281a890051b9e352c8956a7104702a3fa32bc82331a

            Download Submit

          • C:\Windows\System32\vds.exe
            Filesize

            1.3MB

            MD5

            c1fc08495b44dfc735919493bc12f9ff

            SHA1

            c06f4c3f4f35c81a525fca6fe21bcf996f09686c

            SHA256

            967d66f6c7f6259742201e0e87776d151540cf3c1d40d2c07a56109d1d6efc50

            SHA512

            3b6b1b6c00cc739dacbcd848602837196211ad442eff51924e540ab46229572bd337687ceca8e05334f98afe6fc11d8b2151dd1807226141ab08116feaca67e8

            Download Submit

          • C:\Windows\System32\wbem\WmiApSrv.exe
            Filesize

            772KB

            MD5

            a82d9559cb3d73289a4c126f82fd0451

            SHA1

            b947988c8711d34cd44def942aef2d0d2e5203e9

            SHA256

            0aa96cd35e8cb98bfa0134050448bc830e9abef820cc88ba175d7c4d9411308b

            SHA512

            7d8eec37028407faf6797836738706e4fa64a1889db983461a06e95ccf49f7f220c3d1bda97d510245f2034edd449a94e947477908fd557eadedc9aa0fc5441c

            Download Submit

          • C:\Windows\System32\wbengine.exe
            Filesize

            2.1MB

            MD5

            fb86beaace770061d27b85c9f8bbfe23

            SHA1

            7bedff088be829c263987ec450e67146ddea8772

            SHA256

            318649a8bc9e1a0e2da22dc3a77fa50bf6a830e930df7303ee2e4b787ee9279f

            SHA512

            a44ca7ff209df91a58d34cb5cbcc1f1cd54ff8031ec22560ee156b403024fca8c71f4b27e5b8b7d1f8cc29d7d765ae959a5e5319d02c5302664f466f7ac05439

            Download Submit

          • C:\Windows\system32\AppVClient.exe
            Filesize

            1.3MB

            MD5

            e4211c94797d0e13f2ab4ea5f2197a47

            SHA1

            635d39ae32e8c1a42e0f98d0256b73627ed8c7a2

            SHA256

            0917c5464868b87cbd64366fdaff33d5c42d64c1be3a3e8d39962d910d27e826

            SHA512

            d914a230e4cf188dfd7bcc41f4815a7ec4b4c5e390010a17e70c4853324cd96d86c1b70d410723002184b72d73cf990e75df57dd146ee86427f64445ada43d6d

            Download Submit

          • C:\Windows\system32\SgrmBroker.exe
            Filesize

            877KB

            MD5

            c970a398dae21931bd0fe1ee979633bf

            SHA1

            395ed3ea83dce5475c799d9fde96853e7f99a46a

            SHA256

            44d2131fc118ae6d77e84a710a51b35277ee11f54fc617291448cfcea9b9e08d

            SHA512

            6bc8152381df921c05eccacb7a32b29c63c4c7cf14a41fdff95915ef8b3c18b9eacb1d828ff0e8bcd9a01eac1191cf0a4f4a4d39b7d4c9d882b56c20912a017e

            Download Submit

          • C:\Windows\system32\msiexec.exe
            Filesize

            635KB

            MD5

            e2c31a740e95b5da2fabc896347c5e93

            SHA1

            c8d446852efde0abbe29d6c69f6fdbca04620570

            SHA256

            33e6a3e99b5096c67cb759568bd639909d77e6ac794be59bde30bc0150c14045

            SHA512

            cf9a075dcdf4805ff39aae44d279ddcd7d80ea702be65e3e3cede873a76c7890592a5cae0cfdf88bba5b55121f02378f2c93b6a62914de21335d7d57b9594749

            Download Submit

          • memory/1072-910-0x0000000140000000-0x0000000140179000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1072-228-0x0000000140000000-0x0000000140179000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/1128-156-0x0000000000400000-0x0000000000497000-memory.dmp

            Filesize

            604KB

            Download

          • memory/1128-219-0x0000000000400000-0x0000000000497000-memory.dmp

            Filesize

            604KB

            Download

          • memory/1224-166-0x0000000140000000-0x0000000140095000-memory.dmp

            Filesize

            596KB

            Download

          • memory/1224-222-0x0000000140000000-0x0000000140095000-memory.dmp

            Filesize

            596KB

            Download

          • memory/2168-51-0x0000000000510000-0x0000000000576000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2168-46-0x0000000000510000-0x0000000000576000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2168-44-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/2168-155-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/2192-16-0x0000000000690000-0x00000000006F0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2192-103-0x0000000140000000-0x00000001400A9000-memory.dmp

            Filesize

            676KB

            Download

          • memory/2192-23-0x0000000140000000-0x00000001400A9000-memory.dmp

            Filesize

            676KB

            Download

          • memory/2192-24-0x0000000000690000-0x00000000006F0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2468-91-0x00000000001A0000-0x0000000000200000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2468-84-0x00000000001A0000-0x0000000000200000-memory.dmp

            Filesize

            384KB

            Download

          • memory/2468-186-0x0000000140000000-0x000000014022B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2468-93-0x0000000140000000-0x000000014022B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/2552-94-0x00000000005F0000-0x0000000000656000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2552-99-0x00000000005F0000-0x0000000000656000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2552-187-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/2552-101-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/2564-214-0x0000000140000000-0x0000000140147000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/2748-447-0x0000000140000000-0x0000000140169000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/2748-188-0x0000000140000000-0x0000000140169000-memory.dmp

            Filesize

            1.4MB

            Download

          • memory/2748-63-0x0000000140000000-0x0000000140135000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2748-79-0x0000000140000000-0x0000000140135000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2844-144-0x0000000140000000-0x00000001400AB000-memory.dmp

            Filesize

            684KB

            Download

          • memory/2844-217-0x0000000140000000-0x00000001400AB000-memory.dmp

            Filesize

            684KB

            Download

          • memory/2852-1152-0x000002329B200000-0x000002329B449000-memory.dmp

            Filesize

            2.3MB

            Download

          • memory/2852-1150-0x00000232FF7B0000-0x00000232FF7BA000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2852-1149-0x00000232FF730000-0x00000232FF73E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/2852-1151-0x00000232FFAF0000-0x00000232FFAF8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2856-35-0x0000000000620000-0x0000000000686000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2856-30-0x0000000000620000-0x0000000000686000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2856-28-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/2856-58-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/2860-909-0x0000000140000000-0x00000001400C6000-memory.dmp

            Filesize

            792KB

            Download

          • memory/2860-223-0x0000000140000000-0x00000001400C6000-memory.dmp

            Filesize

            792KB

            Download

          • memory/3052-107-0x0000000140000000-0x00000001400CF000-memory.dmp

            Filesize

            828KB

            Download

          • memory/3052-119-0x0000000000CD0000-0x0000000000D30000-memory.dmp

            Filesize

            384KB

            Download

          • memory/3052-108-0x0000000000CD0000-0x0000000000D30000-memory.dmp

            Filesize

            384KB

            Download

          • memory/3052-114-0x0000000000CD0000-0x0000000000D30000-memory.dmp

            Filesize

            384KB

            Download

          • memory/3052-121-0x0000000140000000-0x00000001400CF000-memory.dmp

            Filesize

            828KB

            Download

          • memory/3220-1066-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/3236-1006-0x0000000000400000-0x0000000000A28000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/3236-6-0x0000000001030000-0x0000000001096000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3236-2-0x0000000001030000-0x0000000001096000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3236-0-0x0000000000400000-0x0000000000A28000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/3236-81-0x0000000000400000-0x0000000000A28000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/3360-11-0x0000000140000000-0x00000001400AA000-memory.dmp

            Filesize

            680KB

            Download

          • memory/3360-102-0x0000000140000000-0x00000001400AA000-memory.dmp

            Filesize

            680KB

            Download

          • memory/3784-746-0x0000000140000000-0x00000001400E2000-memory.dmp

            Filesize

            904KB

            Download

          • memory/3784-203-0x0000000140000000-0x00000001400E2000-memory.dmp

            Filesize

            904KB

            Download

          • memory/3852-174-0x0000000140000000-0x0000000140096000-memory.dmp

            Filesize

            600KB

            Download

          • memory/3852-335-0x0000000140000000-0x0000000140096000-memory.dmp

            Filesize

            600KB

            Download

          • memory/4112-211-0x0000000140000000-0x00000001400CF000-memory.dmp

            Filesize

            828KB

            Download

          • memory/4112-130-0x0000000140000000-0x00000001400CF000-memory.dmp

            Filesize

            828KB

            Download

          • memory/4336-218-0x0000000140000000-0x0000000140216000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/4336-907-0x0000000140000000-0x0000000140216000-memory.dmp

            Filesize

            2.1MB

            Download

          • memory/4412-82-0x0000000140000000-0x0000000140234000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4412-73-0x0000000000C70000-0x0000000000CD0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/4412-173-0x0000000140000000-0x0000000140234000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4412-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

            Filesize

            384KB

            Download

          • memory/4428-1068-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

            Download

          • memory/4876-683-0x0000000140000000-0x0000000140102000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/4876-191-0x0000000140000000-0x0000000140102000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/4880-215-0x0000000140000000-0x00000001401FC000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4880-899-0x0000000140000000-0x00000001401FC000-memory.dmp

            Filesize

            2.0MB

            Download

          • memory/4912-227-0x0000000140000000-0x00000001401D7000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/4912-169-0x0000000140000000-0x00000001401D7000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/4912-908-0x0000000140000000-0x00000001401D7000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/5028-208-0x0000000140000000-0x00000001401C0000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/5028-751-0x0000000140000000-0x00000001401C0000-memory.dmp

            Filesize

            1.8MB

            Download

          • memory/5096-206-0x0000000140000000-0x00000001400B9000-memory.dmp

            Filesize

            740KB

            Download

          • memory/5096-123-0x0000000140000000-0x00000001400B9000-memory.dmp

            Filesize

            740KB

            Download