ee404371b2771b91f2909b2e1c69c3b3170801d9e7eb014ed8141d7c86baa450

Analysis

user interaction
yes
max time kernel
94s
max time network
93s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lvrium_loader.exe
Size 823KB
Sample260626-vseypsc15w
SHA256 ee404371b2771b91f2909b2e1c69c3b3170801d9e7eb014ed8141d7c86baa450
MD5 014eccc61ff07673d9e106afc7013761
SHA1 d2ed76fcc2d8f7c8d230c59054e191e096a2ea28
SHA512 785c950378b0170f29dcd631735a448fecfdcf9a55d788aaf40fccba72b78a40c770cc51b8c51fbda6de1d3b33ebc00a220a5e0d4f7fe3aa6dde42ac1975f48d
SSDEEP 12288:ZnAVVVVVVVVVVVQhmo5UJgQnJsls9xrdSHH6fuQF2YdnCcP7Iq:ZbhmfJPneleSYdnCcP7Iq
TLSH
T11505E78256EB0CE9DDE36B7C21DBA33AA735FD748B7A4B679204C13159036C16D2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe\""	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe\""	lvrium_loader.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lvrium_loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\AgentMonitor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Runtime32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{LoaderSvcRuntime64-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{LoaderSvcRuntime64-lvrium}	lvrium_loader.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Core32	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Core32\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5140	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LoaderProc\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Executes dropped EXE 1 IoCs

pid	Process
4816	LoaderAgent.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysTask = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AgentHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeProc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\UpdateMonitor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lvrium_loader.exe"	lvrium_loader.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5140	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
7	api.ipify.org

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\HostHelper.exe	lvrium_loader.exe
File created	C:\Windows\SysWOW64\SvcHost.exe	lvrium_loader.exe
File created	C:\Windows\system32\config\systemprofile\Desktop\CoreCore.exe	lvrium_loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\RuntimeHost.exe	lvrium_loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Sys32.exe	lvrium_loader.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WinAgent.exe	lvrium_loader.exe
File created	C:\Program Files (x86)\Helper64.exe	lvrium_loader.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Sys64.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\SvcHost.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Desktop\LoaderMonitor.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Helper32.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\WinAgent.exe	lvrium_loader.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_1514052935\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_1514052935\manifest.json	msedge.exe
File created	C:\Windows\ServiceProfiles\LocalService\Desktop\Helper32.exe	lvrium_loader.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\SysAgent.exe	lvrium_loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6428	sc.exe
6796	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	lvrium_loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	lvrium_loader.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5128	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269677271240500"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3839916939-1319118069-2256772647-1000\{48218BF0-E987-42B7-8ACF-4723A599F570}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3839916939-1319118069-2256772647-1000\{ADB9F52D-3AC6-4EE0-A113-D8110A50A216}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5140	powershell.exe
5140	powershell.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe
3920	lvrium_loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	5140	powershell.exe
Token: SeIncreaseQuotaPrivilege	5140	powershell.exe
Token: SeSecurityPrivilege	5140	powershell.exe
Token: SeTakeOwnershipPrivilege	5140	powershell.exe
Token: SeLoadDriverPrivilege	5140	powershell.exe
Token: SeSystemProfilePrivilege	5140	powershell.exe
Token: SeSystemtimePrivilege	5140	powershell.exe
Token: SeProfSingleProcessPrivilege	5140	powershell.exe
Token: SeIncBasePriorityPrivilege	5140	powershell.exe
Token: SeCreatePagefilePrivilege	5140	powershell.exe
Token: SeBackupPrivilege	5140	powershell.exe
Token: SeRestorePrivilege	5140	powershell.exe
Token: SeShutdownPrivilege	5140	powershell.exe
Token: SeDebugPrivilege	5140	powershell.exe
Token: SeSystemEnvironmentPrivilege	5140	powershell.exe
Token: SeRemoteShutdownPrivilege	5140	powershell.exe
Token: SeUndockPrivilege	5140	powershell.exe
Token: SeManageVolumePrivilege	5140	powershell.exe
Token: 33	5140	powershell.exe
Token: 34	5140	powershell.exe
Token: 35	5140	powershell.exe
Token: 36	5140	powershell.exe
Token: SeBackupPrivilege	4788	vssvc.exe
Token: SeRestorePrivilege	4788	vssvc.exe
Token: SeAuditPrivilege	4788	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
828	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3920	lvrium_loader.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4072	3920	lvrium_loader.exe	90
PID 4072 wrote to memory of 5140	4072	cmd.exe	92
PID 3920 wrote to memory of 4460	3920	lvrium_loader.exe	94
PID 4460 wrote to memory of 6428	4460	cmd.exe	96
PID 3920 wrote to memory of 5684	3920	lvrium_loader.exe	97
PID 5684 wrote to memory of 6796	5684	cmd.exe	99
PID 3920 wrote to memory of 6468	3920	lvrium_loader.exe	100
PID 6468 wrote to memory of 5128	6468	cmd.exe	102
PID 3920 wrote to memory of 2980	3920	lvrium_loader.exe	105
PID 2980 wrote to memory of 6284	2980	cmd.exe	107
PID 2980 wrote to memory of 1200	2980	cmd.exe	108
PID 2980 wrote to memory of 5944	2980	cmd.exe	109
PID 3920 wrote to memory of 828	3920	lvrium_loader.exe	117
PID 828 wrote to memory of 780	828	msedge.exe	118
PID 828 wrote to memory of 6896	828	msedge.exe	120
PID 828 wrote to memory of 1328	828	msedge.exe	121
PID 828 wrote to memory of 6896	828	msedge.exe	120
PID 828 wrote to memory of 6896	828	msedge.exe	120
PID 828 wrote to memory of 4308	828	msedge.exe	122
PID 828 wrote to memory of 4308	828	msedge.exe	122
PID 828 wrote to memory of 1344	828	msedge.exe	124
PID 828 wrote to memory of 1344	828	msedge.exe	124
PID 828 wrote to memory of 1344	828	msedge.exe	124
PID 828 wrote to memory of 6912	828	msedge.exe	125
PID 828 wrote to memory of 6912	828	msedge.exe	125
PID 828 wrote to memory of 6912	828	msedge.exe	125
PID 828 wrote to memory of 256	828	msedge.exe	126
PID 828 wrote to memory of 256	828	msedge.exe	126
PID 828 wrote to memory of 256	828	msedge.exe	126
PID 828 wrote to memory of 5660	828	msedge.exe	127
PID 828 wrote to memory of 5660	828	msedge.exe	127
PID 828 wrote to memory of 5660	828	msedge.exe	127
PID 828 wrote to memory of 2156	828	msedge.exe	128
PID 828 wrote to memory of 2156	828	msedge.exe	128
PID 828 wrote to memory of 908	828	msedge.exe	129
PID 828 wrote to memory of 6380	828	msedge.exe	131
PID 828 wrote to memory of 944	828	msedge.exe	130
PID 828 wrote to memory of 6380	828	msedge.exe	131
PID 828 wrote to memory of 944	828	msedge.exe	130
PID 828 wrote to memory of 384	828	msedge.exe	133
PID 828 wrote to memory of 6912	828	msedge.exe	139
PID 828 wrote to memory of 6824	828	msedge.exe	140
PID 828 wrote to memory of 1636	828	msedge.exe	141
PID 828 wrote to memory of 4920	828	msedge.exe	142
PID 828 wrote to memory of 4920	828	msedge.exe	142
PID 828 wrote to memory of 2012	828	msedge.exe	145
PID 828 wrote to memory of 2012	828	msedge.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
"C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5140
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:6428
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:6796
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6468
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "Update32" /TR "\"C:\Users\Admin\AppData\Roaming\LoaderAgent.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    3⤵
    PID:6284
- - C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
    3⤵
    PID:1200
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /SC ONLOGON /TN "Update32" /TR "\"C:\Users\Admin\AppData\Roaming\LoaderAgent.exe\"" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff9f5cac188,0x7ff9f5cac194,0x7ff9f5cac1a0
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,9472991452670054994,17280054546743220796,262144 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:6896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11120214981378657648,12498221239445281720,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,14162750377312575493,9109764129132901705,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,2925246977035237018,17042111754795145036,2097152 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,5864916142441022764,17345075949030599283,2097152 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5016,i,9350452850320380929,14278721984551135080,2097152 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3860,i,6181332572806161384,6017835838089308211,2097152 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,12147105851537446531,16206936955965708486,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:12
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,6128902701295915361,6805228816301561656,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    - Modifies registry class
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,12548893187439936161,8071977560504681488,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6447511342019913253,15465577869073309146,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13577652855766011483,3903644966991426900,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,13577652855766011483,3903644966991426900,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,69423007795797966,938511840097479468,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10336265795177623209,10335669139867324010,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:6824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,6359833711625717619,5900915794727498786,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,539719342193944824,11836429513217075105,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,8708079464394120978,16551617065631729292,524288 --field-trial-handle=2356,i,260171474408273367,17786144533147434291,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:2012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:5864

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:6212

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:4516

C:\Users\Admin\AppData\Roaming\LoaderAgent.exe
"C:\Users\Admin\AppData\Roaming\LoaderAgent.exe"
1⤵
- Executes dropped EXE
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1304

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:6096

C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
C:\Users\Admin\AppData\Local\Temp\lvrium_loader.exe
1⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f955c8d6f1a1a3190d5e321035e28ca582fcb76ec2f60d653e90465ff9d1ea00
MD5 0213e77255f07e9c3fc2c451f7a980eb
SHA1 a625e805f5575150fe89058ebdc7b3356ff294ad
SHA512 94f5a80a660d01988274953f2dc96b3f630595c4d1011e0137458475b3b6bda55410996e5d95fff27f7dfa7d3bf4ad111036266eb70344bc4183986e8f524b78
TLSH
T1BBD080277919E851C05611315C39C7795619414B3EE5C20F75D5E04ED8D645063D7547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83748c5f59c12f467f96b0d21c3c9653419dfd0271c8efbdeebbd6ba4bd7548e
MD5 96bfca4318642edfa521d002be0f096d
SHA1 447f1b34ddedc860a8f0bd0c6dc12c229624acab
SHA512 b49889400d8441bd0f61eebe0a2489d48e83671a4d77bfdef519545878aebce5aa04d5e498b1e16dc02fc2a5990edce5232840f2805bd3cf047ef33c92fa70f4
TLSH
T112D080277919E851C0561171583DC779561941473EE6C20F79D5F04ED8D645073D7543
MD5 SHA1 SHA512 TLSH

Submit Download

6cb9feef-6708-42c7-9e51-799e95242267.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6cb9feef-6708-42c7-9e51-799e95242267.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8392146a0f62527dde9e0c77e2344985e66f2c9537c7e31b0d79548c462399be
MD5 ed64db5e0404da4d1f3edaeda7eb2fe1
SHA1 fe5907c883ddb1d7db5502761283c0e2f81ff49c
SHA512 39cc966c4e9180a6c7cf7380ce1993ce4efa142f99e82c98ff0d4ae821e0ec97a380228cdb0e435f69e704febe498fc78ff407adfbd8f6e1e85268eda0a07868
TLSH
T1ECF028AAC9219C3708FD0B2934A44B4BEB6513673B40895F3A3E460C8FF5A3B8646C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c31580a0c2cde229ae0a364cd79a7e4a688f808986db5444b108f6ba4288fc1e
MD5 b6b319ba4b7b38448ba1bb88c6db2968
SHA1 bf2d1c41d13a69a8a2b01c84a37272743ae35e3f
SHA512 6cbc2b5ce9fce44176d6d953b7eaf8c930eb802970dd345a1445a55ee365c282a8d10b428382e762bc6a54e8eb1257278cf13618a0ebcf9c63ec3ded938188e1
TLSH
T15C811AA5B96D0965FF209A7C92E52CBE3772440036C73D0188A0F0B89A46BF66EFE451
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e942.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e942.TMP
Size 3KB
SHA256 dd64385b1ccadea262530cd65fcfd6d49a3c24a8f9405d02ae025751a2e45c78
MD5 5708b6abdc7e563d95a9111b71a6e709
SHA1 ea41e5f019cc64c5bccdf4fb8e58c1302aa7e192
SHA512 144dddea303139a3dcbbe376890eff2a450379ee30f95eeca7add87bddc1d6011fcc3c71458a92f5c2d21a034d19d8b64054d9848e90de95d6b6b4c08a51abaf
TLSH
T1E57180A5742D0961FF209A7D62E22CBD37B2544036CB3C1058A4F0B4DB86B376CFD151
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 273KB
SHA256 657123da10d9c499d2fb63d68aac4ebdc02bd5acb2f182472fa747fbf0494297
MD5 9f09995619b800159922f75cc67d313c
SHA1 2551346a88bc7204c21c7765e8c7f53e59263838
SHA512 767069b9767ef57025d8fe1439424bfebdf5f72848125e46a21f84ec4be3ef9c837ebf07d87e3f4bc738386c5f124306309f6a289d57c7a0b5237593d2683ba4
SSDEEP 3072:7AxsjPWPrWkAvB3LkD+zRg2Y7+FchhhU+IR32pY25ws0i7:E+A+FD+lv
TLSH
T176540A2872A233F9A12EC33E17219C43D7769ACD9A5930D2B4623F1D13F7B443654B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 aca799038696dc94395776ad44d9eb99f232cd70a163d0fc94944ad983e9f5ba
MD5 5cb29c6f1a63bd955fa9d94955483a25
SHA1 8c49fbbaaf90797895638bd53756724473fc2bdf
SHA512 ce31be547ab3c9e8f5fde0bc2bb04458230231abfb0cdc07c447f408f7817d9982bd9acd5fe7bf8d454223847f7b674915ab077b456bfb6f1e6f6344a1b82bcd
TLSH
T161E0D87CC8C9E26F615464D615247B4DD597661F96CDAD4A1F04C804744614CA16D151
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 772c661bdedcdc75bbdfa3bee893674b219af2d59e8b4260274dc93f46196c20
MD5 3f87cd5e92c4c0caf20fb1b59ebcfad5
SHA1 84ea6e96f2ad3e733ab84c9a0cd500842782a3bc
SHA512 342ee28a5e7955ea71896b7ee5e403560d23829368987e738627c1399c4b01e1040abf75d79014db8caae437ed418d64e802782f04846c8fd5b401f96df743ca
SSDEEP 192:D+1Kf2qQ3po+oBidpaij6INFyBhuWxKJiUGo:D+1Kf2qQ3po+oBidpaiGINFyBhuWxKUO
TLSH
T1E9E19DE7C3D4822DD82156F4EB247D2EDE2D0D2483283C6AD9E5EF4B63D6071E244A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fbe182c2460bfef44c64c7f489039dac36a6e104f1465cb19d58e255ba253796
MD5 4434a4f7dd42234f207749faf25a5e91
SHA1 63e46df8e37f857844a7fa94a1207b0e28b284d2
SHA512 3d8cd03b90106aff2007f2c5dec0f85e6d0ac872b6a53df03413fc861bee4d54ed573ffcc796c8b98364b231e618f829bc200494b02750d74690cd09674bb59c
SSDEEP 192:sxRxR/yMqZjK1Ml8wcx/fJsd3PZbTUImAhzoA8p/zydA/g6+WNlbg/BfzmU+oGZw:sxRxoCx/fJsd3RbgI+7/5a/1+j0
TLSH
T12572EA166974597B8CDBD619FA45BB57D3F91523F2804E44AAFC8A0C10EBAEC2113C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c976cb57c35e3881fdb396a11ac7d30779bbb9ca764338cc9bd6856e3b452c24
MD5 cf57f18ddae500662585af403484a0bd
SHA1 fe0d6733a80bdb89f7f628a848d6a194ad99aee2
SHA512 5ebf98b7de19d71410a8102a6a5b111219c1e46f44ff1e386eb47e3ef648c42f43f51cbe3b817dc0a2cb26e65f9e7e3066dd4e73ba5b32d0cea48f90d3ac558a
SSDEEP 768:BawEPU7pLuL7IlWgfDfEN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9qYLfaDro68InG:BawEPYE7IlWgfDfENu1jaCqYbaw68Is1
TLSH
T151E2EC7B680CCB7E4F444E9CEC29BE9A6DE801CF96D88D5447EA440C03C6BEB51165EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d66f2c39-b89e-487c-9518-6ad3dd854803\index-dir\the-real-index
Size 2KB
SHA256 bca73ca2fa9ac99b4f3e8606d0a87ac7ae3239ff4d82ba0f7c64f6651f899644
MD5 a6dcc2f52afb0af715785827966fd678
SHA1 7aaeea866f6f2fbf8bfa719c1e3bfb1030d47a0e
SHA512 ca2b6d38f42b563456b1f0799d0c048998d361c4c434963c89d3c740296a49dedefbefe96791e097e9c05ddbeeb9704abadb83a33025592cd31351f9fdb109fa
TLSH
T12151778DC980579ECCB562FB1D5414B693B52C24FC0CC39190A8F5A27453AA817472FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d627.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d66f2c39-b89e-487c-9518-6ad3dd854803\index-dir\the-real-index~RFe58d627.TMP
Size 48B
SHA256 4268dca3d904bd120e155120d73b1f1f88a0eabcb64113918c6d5bf7ac1ac0fa
MD5 7db69ebae484a288ee31545c6ce363f8
SHA1 60544c40a9d5c18ecf3d010d33bb3e3e2cee0af2
SHA512 c4824521462bf70b5717b40773d808c149c8c81dd7d0d9588f0afee5e032353e38d60abe19c35eb6a39931e20d521637a1d1d66f903a42e46de2107cb721da01
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 982e58e34cdc95269c735b8b01b3d2dd244cd943cd5ad7705278854e01c1b00c
MD5 c6449282df17435e39f6269cbdb36912
SHA1 a0f5703e0219ccdbbe6771c595e741ce3fda074c
SHA512 04938c5bb79955e877898ea236274ac6dfb9d7dd699dde968ad637e5870b62dec423133fdec868a6f1970913c01a2688edd307e3d6897478b3ecd298e1eca6a5
TLSH
T1A5D022D76230E88712B1EBC01C3C19AD8A0F5F05CD89CCE8CB4AF4623078B03C68AB24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 81072500da870f6e8602a2182c10c5dd847fd3b9f32b5985ed2b1569b68864b8
MD5 778baebbce5377d22597dfc21fdba77b
SHA1 ea980841e9f3269ed4112db6b672cdb3d2011d2e
SHA512 2fa4e65ec441a22a1dd357426b882226679271f81519c2b6ba2b211b23d0bf1db8352719cd514f89408593f02b6175336e55d835c0c7ffa90ee8da68487d397b
TLSH
T14DC09BE35520A5CA06B5EFC4143C661DD90F4749CCC0CDF8D158A4012134D534585525
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 99267d671ac844928a2672316b030e70636668b40215f7754b026c64f87258e9
MD5 c19815f4c926ae70fc1ac8f723b87243
SHA1 3020d622168e6422dbb019d628fecc6b6a8a029f
SHA512 f11d52d39f9c83dc5cf759b9ecb8c5c802ab39d1bcc60dfe35eb0e75acc5468c548a957fa7e9ab3679625b9f1bafc3c75a8d2ac7daa36b4c0fa9ef881a5ce356
TLSH
T1AFC02BE3142095C606F1EFC4203C2A2DC90F4348CCC0CCF8D548B0022328E034080520
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588122.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe588122.TMP
Size 137B
SHA256 1868a608d791338972272926b5a01147d6bbcb5040e1a1630e92bf93e735adea
MD5 1ead46ee78fe760b868903250b6e4ac1
SHA1 83a39bc9762321be2f8b0b51b74f3fba7be40ef3
SHA512 234cc3aeb114d97db7d5cab7535a3468d8f0d3cc42b4d0b4bdd914182c22964fb4a26c69f4f2c58d0f14cf7f46303cf714b5a1e48e5a36188678dce3d7481235
TLSH
T181C09BE3553065C607B2ABC5143C665DD95F4F49CCC0CCF8D159B4013134D1385C5525
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 96B
SHA256 54d55ccba5cca3039b4b6d37932be20cd86b1cafbd4f1b88b9e8096c3e60aa10
MD5 75c9f86a64fbc46a2eec02918c77830e
SHA1 944f0c43efbf579b9dd85c181f4b300024dfc3e8
SHA512 e5c756354502802bb56c10832351e2f59940da037e34a6816a3f151e49d3eb784790a498db2596e1d5ca6484fd5beb1be1ed1d4fbad2a9e44a99a6e16e9b0a78
TLSH
T16DB02200880E0023CA002BF0C8E320CC32A0CCCC020A322008ACC0FCECA23C02283002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d05b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d05b.TMP
Size 72B
SHA256 254dbd32635707aa5b1ca1a5d567afe2ba527e86e2fe5e5d08efe5cb4ba6d4ba
MD5 93c451b446dbf8b9cb8a45e0758aa07e
SHA1 272e7f580b4c270fb111063d3289d8017249433d
SHA512 6e9dc29b9e98157920f9de892e8625bdfa78b2a25f7b0100d9c2cd6a0b306a5fd7d0cfab6816feb7ab3ec4ae9b1bf3757f9dd6c2a9721d2c395f428b289f264a
TLSH
T1CDA00220C2CE1830C40425B1152A22402790DD61421E36025490D9A8EDE10C0B551131
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 96738438fa3bac3ed4a7ec4a19bad64b9499d7e54168b33bb1c30e3b1b9d0499
MD5 5248409cdf59c45a7d18f34755316784
SHA1 628d9fbd7cdac80d8305c9e91ad6366c03ed9ecd
SHA512 a6b1aa53444084b9372f8e31a7775d72a062d8215574cec1ee885268b90943874c6bc396a1f923532fdb497fcac9716ed34adc01f76a38739dda33ba58244347
SSDEEP 768:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwJbBRr95InwnL:cdYt3tEJdTHLGHaR1xBprW9d6T9bLzwf
TLSH
T18EC23B15393E230139BE2908E195966F634234B3301AA63B3BBD60F60E67E015FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9cb97e83a15392ca4f4ec1a32be1d368521bbe52218b78d241d0b2c21cf02261
MD5 305c5a62f1ab303da76f53450b24ba26
SHA1 f8cb4da2e5fa76a71525e2d253da96eda990b040
SHA512 822aa9a648a428670f3618390e53f00f7d844e08cbf2b176efc96f3124d773d1642777272bc04f47fa8851ce6ea19b11a4cb673892eadddf8ae0c232549a6d32
SSDEEP 384:nuiF1tNn/s3n9SS8NS8TUNTUlIR5hESuKsvTCf6VA2Zc3/kuyXimcmn15wbAjEJQ:FF1j+9/zwglEf/Vq8vcmn12bf+
TLSH
T15DE2C4F298E78977D8AE4B87633D2E469AFCC163B4885994F7C44D4CCC862BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cdb2753682a22b65e223ac49284399cf2169a34479056bddfd2bc9ea90ec519c
MD5 08e863a67a413284d05cba48159674b9
SHA1 b0e94513cb0ac9cf515287c2b409a9417691f1aa
SHA512 86759abb804c197befc839f3e29f4289b7e947c9505f4b7b350ff421eb8e032b875a9548852701867e33517b5488ce68044941f07d939f8ffe8339aaefdff4f0
SSDEEP 384:ngiF1tNn/s3n9SM8NS8TUNTUlIR5hESuKuvTCf6VA2Zc3/kuyXiGcmn15wbAjEJQ:7F1j+9lzwglEV/Vq8zcmn12bf+
TLSH
T167D25B32D864CE77ACEB8FD9B34A7647AEE401A3D5889AD8D9C94D4C00D72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c885ccde3cf214cfa69265cc3a71259eec099499108a54d113039e912e129111
MD5 c434dbfdb1872b3f30e4063fdeb2ee7b
SHA1 a921b01f911874d7dbb98a2b3287869a86d3ec24
SHA512 fa2ba8dd51961f2bd71d9495ce666f5c0e60c7c138cb53ea94cb2e626ca6d7dc431a935995b2c00a243e154a31c2e8459a8be5aa2134ef657b1e9267e9a9ce3d
SSDEEP 384:naiF1tNn/s3n9SM8Nt8TUNTUlIRshESurWxTCf6VA2Zc3/kUxITGT0I18Lk1IzBB:RF1j+9lgwgIEaFVqLxi+0DvZ
TLSH
T11CC23A32D864DA77EDFA8FD5B70A7A4BAEE001A3D4C869D4DAD81D4C00872DD1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ada969b81f27e3fca912f37adca53342ae8db77ddca10f072cc6410e801afed6
MD5 0430b18bf46cd23632acd5b5d1ebb15e
SHA1 bc02a1f5af560cbed0e7e9291873eb924113fa65
SHA512 63f35730d474b5546c3218ed0cabf086679b91436e2f6a5c26a354c5cfe9c1c243a7d3e9986f1fb86a30e8c55ad24ef6a748f972114ba1330b20ff081e7b1a62
SSDEEP 384:nliF1tNn/s3n9SM8NS8TUNTUlIR5hESuKuvTCf6VA2Zc3/kuyXiGclhp8Lk1IzOQ:sF1j+9lzwglEV/Vq8zclTv4
TLSH
T1E2B24B32D865DE77ACEA8FD9B70E7A479EE001A398889ED8D9C95D4C00C72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_d1ottd5v.3g3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1ottd5v.3g3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LoaderAgent.exe

Path C:\Users\Admin\AppData\Roaming\LoaderAgent.exe
Size 823KB
SHA256 ee404371b2771b91f2909b2e1c69c3b3170801d9e7eb014ed8141d7c86baa450
MD5 014eccc61ff07673d9e106afc7013761
SHA1 d2ed76fcc2d8f7c8d230c59054e191e096a2ea28
SHA512 785c950378b0170f29dcd631735a448fecfdcf9a55d788aaf40fccba72b78a40c770cc51b8c51fbda6de1d3b33ebc00a220a5e0d4f7fe3aa6dde42ac1975f48d
SSDEEP 12288:ZnAVVVVVVVVVVVQhmo5UJgQnJsls9xrdSHH6fuQF2YdnCcP7Iq:ZbhmfJPneleSYdnCcP7Iq
TLSH
T11505E78256EB0CE9DDE36B7C21DBA33AA735FD748B7A4B679204C13159036C16D2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-35-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/2324-36-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3744-352-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-432-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-140-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-541-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-533-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-519-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-510-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-509-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-483-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/3920-449-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/4516-39-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/4816-41-0x00007FF7007B0000-0x00007FF700819000-memory.dmp

Download

memory/5140-22-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-12-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-27-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-26-0x000001C5E7240000-0x000001C5E724A000-memory.dmp

Download

memory/5140-25-0x000001C5E7280000-0x000001C5E7332000-memory.dmp

Download

memory/5140-24-0x000001C5E7260000-0x000001C5E727E000-memory.dmp

Download

memory/5140-29-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-0-0x00007FF9F54BF000-0x00007FF9F54C0000-memory.dmp

Download

memory/5140-1-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-21-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-15-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-14-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-13-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-28-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-11-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-10-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-30-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-9-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-32-0x000001C5E6F59000-0x000001C5E6F5F000-memory.dmp

Download

memory/5140-33-0x00007FF9F5330000-0x00007FF9F5CD4000-memory.dmp

Download

memory/5140-7-0x000001C5E6FA0000-0x000001C5E6FC2000-memory.dmp

Download

memory/5864-37-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/6096-351-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/6212-38-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download

memory/6284-34-0x00007FF7D6DF0000-0x00007FF7D6E59000-memory.dmp

Download