71e939b98b8bdd77b8178362399d5a6a49bc24d8cf7882f4ab1030be3e14d435

Analysis

user interaction
yes
max time kernel
44s
max time network
54s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/07/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GitHubDesktopSetup-x64.exe
Size 294.2MB
Sample260730-cxy82axeqa
SHA256 71e939b98b8bdd77b8178362399d5a6a49bc24d8cf7882f4ab1030be3e14d435
MD5 a2893f539ca89eb87e3b970955afc395
SHA1 1f0b3e15661dc5a936045dc46301a9e2453874cb
SHA512 e8e3f68d265198484bb791b64ef0a70be6ffa9f6649ce15a0cef879cb209b9488e1a4f137e663e42fa2e6fde914d25dfd2ed19ada36296f155d4da4b60258ffe
SSDEEP 6291456:QWUDoYAO8v9AvVMUNuHgzceN0Tqdl/oium0Cb8Xv4wjxhgEimDIC/Lp/:Z2oYAO/dMUNuHk/dl/odJEhE4C/LR
TLSH
T1ECE833AFD47153A6D410CE33E010FEB2F5B86D562A6C6DFA522003957F9B2D0632B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	GitHubDesktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	GitHubDesktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation	GitHubDesktop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 39 IoCs

pid	Process
4772	Update.exe
3524	Squirrel.exe
4128	GitHubDesktop.exe
4940	Update.exe
2100	GitHubDesktop.exe
4320	GitHubDesktop.exe
3452	GitHubDesktop.exe
696	GitHubDesktop.exe
1868	GitHubDesktop.exe
1336	GitHubDesktop.exe
2396	Update.exe
3488	git.exe
2384	git.exe
544	git.exe
5108	git.exe
644	git.exe
2528	git.exe
564	git.exe
4632	git.exe
3564	git-lfs.exe
3436	git.exe
5016	git.exe
3256	git.exe
4056	git.exe
1256	git.exe
340	git.exe
3304	git.exe
2560	git.exe
3416	git.exe
3320	git.exe
4064	git.exe
1200	git.exe
2464	git.exe
3576	git.exe
3736	git.exe
4448	git.exe
3480	git.exe
3636	git.exe
3308	git.exe

Loads dropped DLL 64 IoCs

pid	Process
4128	GitHubDesktop.exe
4128	GitHubDesktop.exe
2100	GitHubDesktop.exe
2100	GitHubDesktop.exe
2100	GitHubDesktop.exe
2100	GitHubDesktop.exe
2100	GitHubDesktop.exe
3452	GitHubDesktop.exe
3452	GitHubDesktop.exe
1868	GitHubDesktop.exe
1868	GitHubDesktop.exe
1868	GitHubDesktop.exe
1868	GitHubDesktop.exe
1868	GitHubDesktop.exe
1336	GitHubDesktop.exe
1336	GitHubDesktop.exe
1336	GitHubDesktop.exe
1336	GitHubDesktop.exe
1336	GitHubDesktop.exe
2384	git.exe
2384	git.exe
2384	git.exe
2384	git.exe
2384	git.exe
2528	git.exe
2528	git.exe
2528	git.exe
2528	git.exe
2528	git.exe
564	git.exe
564	git.exe
564	git.exe
564	git.exe
564	git.exe
4632	git.exe
4632	git.exe
4632	git.exe
4632	git.exe
4632	git.exe
3436	git.exe
3436	git.exe
3436	git.exe
3436	git.exe
3436	git.exe
5016	git.exe
5016	git.exe
5016	git.exe
5016	git.exe
5016	git.exe
3256	git.exe
3256	git.exe
3256	git.exe
3256	git.exe
3256	git.exe
4056	git.exe
4056	git.exe
4056	git.exe
4056	git.exe
4056	git.exe
1256	git.exe
1256	git.exe
1256	git.exe
1256	git.exe
1256	git.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GitHubDesktopSetup-x64.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GitHubDesktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GitHubDesktop.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GitHubDesktop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GitHubDesktop.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-client\shell\open	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-client\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\GitHubDesktop\\app-3.6.3\\GitHubDesktop.exe\" --protocol-launcher \"%1\""	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-desktop-auth\URL Protocol	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-desktop-auth\ = "URL:x-github-desktop-auth"	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\github-windows\URL Protocol	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-client\URL Protocol	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\github-windows\ = "URL:github-windows"	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\github-windows\shell\open\command	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\github-windows\shell	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\github-windows\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\GitHubDesktop\\app-3.6.3\\GitHubDesktop.exe\" --protocol-launcher \"%1\""	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-client	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-desktop-auth	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-desktop-auth\shell	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-desktop-auth\shell\open	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\github-windows\shell\open	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-desktop-auth\shell\open\command	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-desktop-auth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\GitHubDesktop\\app-3.6.3\\GitHubDesktop.exe\" --protocol-launcher \"%1\""	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\github-windows	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-client\ = "URL:x-github-client"	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-client\shell\open\command	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\x-github-client\shell	GitHubDesktop.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4772	Update.exe
4772	Update.exe
3564	git-lfs.exe
3564	git-lfs.exe
3564	git-lfs.exe
3564	git-lfs.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4128	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	4128	GitHubDesktop.exe
Token: SeShutdownPrivilege	4128	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	4128	GitHubDesktop.exe
Token: SeDebugPrivilege	4772	Update.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeDebugPrivilege	2396	Update.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe
Token: SeShutdownPrivilege	3452	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3452	GitHubDesktop.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4772	Update.exe
3452	GitHubDesktop.exe
3452	GitHubDesktop.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3452	GitHubDesktop.exe
3452	GitHubDesktop.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 4772	1440	GitHubDesktopSetup-x64.exe	84
PID 4772 wrote to memory of 3524	4772	Update.exe	90
PID 4772 wrote to memory of 4128	4772	Update.exe	91
PID 4128 wrote to memory of 4940	4128	GitHubDesktop.exe	93
PID 4128 wrote to memory of 2100	4128	GitHubDesktop.exe	94
PID 4128 wrote to memory of 4320	4128	GitHubDesktop.exe	95
PID 4772 wrote to memory of 3452	4772	Update.exe	97
PID 3452 wrote to memory of 696	3452	GitHubDesktop.exe	99
PID 3452 wrote to memory of 1868	3452	GitHubDesktop.exe	100
PID 3452 wrote to memory of 1336	3452	GitHubDesktop.exe	101
PID 3452 wrote to memory of 2396	3452	GitHubDesktop.exe	102
PID 1336 wrote to memory of 3488	1336	GitHubDesktop.exe	103
PID 3488 wrote to memory of 2384	3488	git.exe	105
PID 1336 wrote to memory of 544	1336	GitHubDesktop.exe	106
PID 1336 wrote to memory of 5108	1336	GitHubDesktop.exe	107
PID 1336 wrote to memory of 644	1336	GitHubDesktop.exe	108
PID 5108 wrote to memory of 2528	5108	git.exe	112
PID 544 wrote to memory of 564	544	git.exe	131
PID 644 wrote to memory of 4632	644	git.exe	114
PID 2528 wrote to memory of 3564	2528	git.exe	115
PID 3564 wrote to memory of 3436	3564	git-lfs.exe	116
PID 3564 wrote to memory of 5016	3564	git-lfs.exe	117
PID 3564 wrote to memory of 3256	3564	git-lfs.exe	118
PID 3564 wrote to memory of 4056	3564	git-lfs.exe	119
PID 3564 wrote to memory of 1256	3564	git-lfs.exe	120
PID 3564 wrote to memory of 340	3564	git-lfs.exe	121
PID 3564 wrote to memory of 3304	3564	git-lfs.exe	122
PID 3564 wrote to memory of 2560	3564	git-lfs.exe	123
PID 3564 wrote to memory of 3416	3564	git-lfs.exe	124
PID 3564 wrote to memory of 3320	3564	git-lfs.exe	125
PID 3564 wrote to memory of 4064	3564	git-lfs.exe	126
PID 1336 wrote to memory of 1200	1336	GitHubDesktop.exe	129
PID 1336 wrote to memory of 2464	1336	GitHubDesktop.exe	130
PID 1200 wrote to memory of 3576	1200	git.exe	133
PID 2464 wrote to memory of 3736	2464	git.exe	134
PID 1336 wrote to memory of 4448	1336	GitHubDesktop.exe	135
PID 1336 wrote to memory of 3480	1336	GitHubDesktop.exe	136
PID 4448 wrote to memory of 3636	4448	git.exe	139
PID 3480 wrote to memory of 3308	3480	git.exe	140

C:\Users\Admin\AppData\Local\Temp\GitHubDesktopSetup-x64.exe
"C:\Users\Admin\AppData\Local\Temp\GitHubDesktopSetup-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\Squirrel.exe
    "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:3524
- - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe
    "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe" --squirrel-install 3.6.3
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe
      C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe --createShortcut GitHubDesktop.exe -l StartMenu,Desktop
      4⤵
      Executes dropped EXE
      PID:4940
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,9106434181769211306,4867167883124232424,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,9368316671586460438,358269792211883410,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2100
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=1900,i,9106434181769211306,4867167883124232424,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,9368316671586460438,358269792211883410,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1944 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:4320
- - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe
    "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe" --squirrel-firstrun
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=1976,i,2005422838849495400,3956910203089700752,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1980,i,3903884400659249718,12536021789457538655,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2056 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:696
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,2005422838849495400,3956910203089700752,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1980,i,3903884400659249718,12536021789457538655,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1972 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1868
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\GitHubDesktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --app-user-model-id=com.squirrel.GitHubDesktop.GitHubDesktop --app-path="C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app" --no-sandbox --no-zygote --disable-blink-features=Auxclick --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1976,i,2005422838849495400,3956910203089700752,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1980,i,3903884400659249718,12536021789457538655,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2728 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe --version
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3488
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe config -z --global user.email
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:544
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe config -z --global user.email
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:564
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe lfs install --skip-repo
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe lfs install --skip-repo
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\libexec\git-core\git-lfs.exe
        
        git-lfs install --skip-repo
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git version
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false rev-parse --git-dir
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false remote
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.process
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.process "git-lfs filter-process"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.required
        8⤵
        Executes dropped EXE
        
        PID:340
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.required true
        8⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.clean
        8⤵
        Executes dropped EXE
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.clean "git-lfs clean -- %f"
        8⤵
        Executes dropped EXE
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.smudge
        8⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.smudge "git-lfs smudge -- %f"
        8⤵
        Executes dropped EXE
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe config -z --global user.name
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:644
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe config -z --global user.name
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe config -z --global user.name
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1200
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:564
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe config -z --global user.name
        6⤵
        Executes dropped EXE
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe config -z --global user.email
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2464
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe config -z --global user.email
        6⤵
        Executes dropped EXE
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe config -z --global user.name
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe config -z --global user.name
        6⤵
        Executes dropped EXE
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\cmd\git.exe config -z --global user.email
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3480
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe config -z --global user.email
        6⤵
        Executes dropped EXE
        
        PID:3308
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe
      C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe --checkForUpdate https://central.github.com/api/deployments/desktop/desktop/latest?version=3.6.3&env=production&guid=453b47f9-c59d-481b-a97b-272daf7ff05b
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GitHubDesktop.exe

Path C:\Users\Admin\AppData\Local\GitHubDesktop\GitHubDesktop.exe
Size 391KB
SHA256 f6aba0d5adae83586793803cbb43dcf88b90911e7c103899bc11c8439bca1718
MD5 b3134818391bad18402415d239b53aa7
SHA1 422a20b119e979da569b7c34056e3c7351ec460a
SHA512 95fa69a9a985b0131022b9c8f45fe66f453d87c37fc1826220c49acad3b0ff9ef105be877f860d807036eb9cfbfdbf75ed9db67d203ab0fe651549f4872a9e54
SSDEEP 6144:oZzvhs2Z4n1E7g34XtVYAOfTdYsZVb9dbKE3sgcXnYVKxgSUI:oJ+2Z4nShVY5CsZV1sg9CgSUI
TLSH
T1A6849E3274C3C0B2D5E1A6342DE8EAA1E579FE610AB8193B37D4336D1D742D18633E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\dxcompiler.dll
Size 24.5MB
SHA256 1c335d417c2b39d43d5bb007dc9070156200146e9011ec2dc29311aba06c1310
MD5 f68b99d415ffdbe6e8f0d7e8711bab8b
SHA1 f0551eb1cbee687b0e46279c915ab5130a8665b3
SHA512 6a7080c5eb3217e7c9995c60214fb975554fa53096ec42649c7f6382881fb5c46ba26348e3669e5ab228c9e1d660e4a3f1a318bfd530a20c346b21acb33765f4
SSDEEP 196608:DWxkDUHlgJWwgvYtoexSGkJ+ccXP2BPUNkiAqAN+nNtbR6:DEkDUHl4Wwg2xSFJ6XP2BPUNpQN+rR6
TLSH
T1BF4729122646D49DC099C879C7678B268A6C30E73FA7B9DFC0F451252B79EBC4B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\ffmpeg.dll
Size 2.9MB
SHA256 5f0ff9d0efade608b37faba69aa4729512701645b2a0239ff145a4f88367442a
MD5 c3012b607c18f57a23050e5cc8413532
SHA1 414eb1a0efc558c4f8a8b0083c4d97e4f8f81bbb
SHA512 274e228825fd01a9d73d5d56a85d30d6a20fc9e3b3c70281e3c79a2592ddb1cb19f8a1b20f0b87299c34f9dc8a5e0824b109a2c1bb0c295af3a42e35cc6923e1
SSDEEP 49152:CD4JOs9bUAtjcqOEYcvDb199aPLKIbH7k6Q4gNoJqFfwYd7fz:CD9+UAdcqbvDdRNoJ23b
TLSH
T167E5AE02F6D651DDD029C03497AF9213F631380A4F205AEB1A905A263F67FD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\icudtl.dat
Size 10.4MB
SHA256 c5da2fc389d1bb0ecb13fe22a8e069b7abc491f8aa5d16eb65d4ff32c85a46b6
MD5 5b29b82022f9697b3010b05b2a71535f
SHA1 eed88ddce48046b1a5c5fcdd19cd9c5a81d8c4bd
SHA512 bffa945bcb95b13e69a438afdcbd6d5a490db902896ed4380c7d7c61a4e53b35d73d44d75eaa7debae65e308b01b287411f168ea4377360045afe8a6b9cfa09c
SSDEEP 98304:D/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndP389o:D/cBhORok2HiXUxO/RJk3IWhlYntjdqo
TLSH
T179B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\libEGL.dll
Size 511KB
SHA256 4ec578c67d7f824f7beacf789c201cc8ae6703d6ff0394c5cd225f543af3fbb9
MD5 4a98c8d4e013c1aae4e73eb2615cc748
SHA1 3222948ce91701cfefba4091a415ddaa7c78d46f
SHA512 7a15e4f3b9279c3132c1c1a2aae743949a8a8c3749a4061e9472173c3b6719174a4527b3c56ec157ba5888f4043689f865b9ce8ddcacaa718c805d28c853763b
SSDEEP 6144:fVjuHfNwVk2IcwksKrkL6xIdjZwL5/Q5Tmcql3JeLBo6IXtOqoQq9OSMPTS:f1WFj22k86x+U/Q5TmcqveL+6NapSL
TLSH
T12BB48D15F3E946A9E07AC1348A538643EB75B4820F65F9EF02E092752F37BE45B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\libGLESv2.dll
Size 7.7MB
SHA256 d2672abddaafbfca232db4f36ebf320665e0cc93295758ce5f8084fdb03321db
MD5 40b46ba041abe442a1e06e1f66bb8ed3
SHA1 7c44e2a34600ad3613e341ab676f6f46b401399b
SHA512 4964cc394ae2e5e41067f8f77eaf2b4e628e5594d619eaa9765aaca4753edf4f25fee8a27494028d262e720a2c99e7ffef2bb884c7c135568016a36af60b2b29
SSDEEP 49152:YLe6/cUFf6P7ql0XwFExC3QOvRF5ZCZupBkPm6VsYywolfcIaqp03zTUmxuPblQA:YUUMWNMCpdlfC80n+dYYGuOkq1+Ln2o
TLSH
T18C867C03F69641D9C05DE2788757A223FB34B8450724B2DF2AA457152F6AFE0BB3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources.pak
Size 6.6MB
SHA256 74c4be8feca65976312f9ddd6ed8f06b669f6a551c91c9b67f9dc76d84e7e97b
MD5 918b877465c1089d08dbb671c76a6ca6
SHA1 76a7b9ef9b58bcc5ac4f20133d2df9293551bbdb
SHA512 41c5d734200bdc276b6a7410bc4b5eed23babcb88f4095696c3049e6885efe7766a9066ea8e3f48249f6588a81d78d67875bc5849e479e2dd5363bcb26b60ffa
SSDEEP 196608:AsBRgrfB5GE3u4bkriACmZnC3gEL34tYrW:fTI6AkrDntEoYrW
TLSH
T1376633D267D2A81FCD80677A85488F35599C6E2535D0B1A3448D6129EEACFAC0FC0B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop-notifications.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\desktop-notifications.node
Size 344KB
SHA256 492a8c491202394979a6f6ab2d36aa482e4d868d2bab77f03eec4cb7acd2d269
MD5 40d007a34ee766d6889c2360314611a8
SHA1 ad53175cf8405892b102a2fd15fd38d02581cbaa
SHA512 0b283afab6338e20ae681a5da512cbd82948d8b62c9ea0c0ef929fd21131e698eb69c53ab437bcf1f033464e976b889a31bff149e787270b3085af7f9c13c462
SSDEEP 6144:F8bnknyCFNeyMBD4L7Zrpey7iWvb+HUE+c0X+Zp9SeYQ:mbnmM8NIhWyb0X+QeYQ
TLSH
T1B4746C5AF6B41476E167C138CD934906EBB27C4607B1D6CF13914A8A2F33BE1963EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fs_admin.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\fs_admin.node
Size 619KB
SHA256 747b19e1bde65bed62eb06b53b0189281c479d7d8e8c61d350386d09f69d3f75
MD5 b0bb3ab477415ac8a0ec174d11f51164
SHA1 ee9a3d3be7749742349505d79d7428db9eec2285
SHA512 225b751d635e9f3e305668102c398f0a3116782d3d792b67afe7857a146641276d23e26b4929748d484d52c613f2efb83b1abf961414d98dd717912f5732781d
SSDEEP 3072:3lJctdDpbVAwJWjxK5osDiNGqoQMIilJM4WtMgBtKy4R6nWWeCRL9UT+QSKghAqQ:1JmARI5osD1qoQMVJnyynKR4uMUXcE+
TLSH
T1C0D48D6A7798129AD17BD23DC6C74B5AE6B27411433097CF02A453AE1F17BE81B3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git.exe

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\bin\git.exe
Size 4.1MB
SHA256 c115a66a1bede6694b513af420cc90f8775be03666a54d1ecb82d6196b929fe9
MD5 66e8226f7cdadde28edbbf9c8bf12f3d
SHA1 5e08219e2e9cba19d6b40eecb6fc34e688dd40be
SHA512 d05c22a0c496659349db1ce417cdd200939d3fed0f10f6b18ae94d0e2e64b558a8a43f85df72a6f8bba1ad2f1fd537fcb40903e137c6d652f3478aa62cb5e9ba
SSDEEP 49152:iXBm5Fp6khQyRexXTlTzXUwh2qbgFQsNxftjsdNvOJvmKWDNHPSBG4afLRt0Eg53:UKBQHFZIiuntUyfWgG4MTg5ZF
TLSH
T12A163907E2A360ECC96BC1358656A732BA72F85801347E7F5694CB302F71E60576EF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING.LESSERv2

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\git\mingw64\share\licenses\libtasn1\COPYING.LESSERv2
Size 25KB
SHA256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95
MD5 4bf661c1e3793e55c8d1051bc5e0ae21
SHA1 714f44a04b7807f4207e645d57aa73240e7e5d69
SHA512 e7e968ad0983d03f6bea8b35de580ce6d717fd4ade95e32ed26807d8ae89631c0f188a7a18f9eefba9a2eba46c31aa8b1f2aaa56621dea1df5140919b441ba39
SSDEEP 384:LY56OuAbnn0UReX6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7ups0CZuQd:LY5trLeDnFMz1ReScmc7GshZuQd
TLSH
T160C2953EB70113B206C206915A0FA4DFE32BD07932675A64749DC15D23AB83553FBBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\index.html
Size 236B
SHA256 d44d3b8f637b17fc75c9f3ea14bc08166a7fa931de46b6ea41971ccd6131f553
MD5 50e5c22a717d067ee23135702cb231e2
SHA1 3dcfb4e6d90ee38fc0dd51e812c791ccdd395af8
SHA512 d45cacafcaf96b217939bddedb7374ce93415b08882c918c37c9ce8c2cdd5c525ef4153796bc15e40cae36518696971a52fe5d209bdaa69328fb4299075df506
TLSH
T136D0A7DBCC21101CD6A07E99EDD2F60DDC8E8D09D5C95C0436E5507E44C8B55DD0AB04
MD5 SHA1 SHA512 TLSH

Submit Download

keytar.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\keytar.node
Size 706KB
SHA256 dbe5e98e1541d4ed386d59c448610ffdb285f495e837669a261819746f9b4529
MD5 45a47d9f54e26fe0466c4b6e15b93801
SHA1 f6ceb36bb4d6d5cc1756ab33f0b1c15000cc1852
SHA512 ac70160148891ba9ff906ab12db2c100b3ef193bdb1662babd3a44c8cd04307302110de6d030351ce6e1f690b6cda79dffd205c78b21d2ae3530e8172ce5534c
SSDEEP 12288:FRInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOa8j:FOnDHpqnaskrdaM
TLSH
T186F48E6637E811A6D0BBD13FC5978F99EAB1BC140720A7CB01D442A92E13BE85E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\main.js
Size 235KB
SHA256 35d42f05901fd5b712410ac949c16fd1fee5db2b7d51ce6e11baa715617f7071
MD5 c249dd73638528f6d73b62dc491b3aee
SHA1 f396cb0ef3ffb143dbaac7d27591f4c6634570b0
SHA512 2eb6a8ff3980817c9448ce19a907d329e93d30d02f9ae621fae0558da6dd69e4725befd0bda1fe6eff7582384ab4dcec91f55611cf5241e501539c9dda598b64
SSDEEP 3072:hQbgiFJgKavjUFO3rEtqt1G5JdC23KdjSM4nKUy0iTVH3SUG5I3/8t:h7irO3sM4nlUNG5Iv8t
TLSH
T1183429CE72A5B06143E361B5402F550BF3364D2A680D94A8F368DCEABC7985E5277F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js.map

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\main.js.map
Size 1.2MB
SHA256 5f44e70f2e21de9aa00bf9b252c6ea1ae4677bce6a93efc3c8ed989e0d3d121b
MD5 1cc05fdc837e12cccc38afe2386a5d60
SHA1 d25032d5b31ef1c39cea965e864f7c24dc8df3c6
SHA512 e1138b0c5ed9bee98c0c5f7fd5126e7d1a8715817f2a1f4bff733aee30614e6b2e76951af35149165a897efae35305c1b900b9c0c316af033cf323b84196b547
SSDEEP 12288:/zJxkZ2/BuiKNYPoBlGr5rUum9Bz394q9biKe:/zJxMiKq4lGdUum9BzNT9biKe
TLSH
T14D450A5736BBF5364B5317E65FCF8085B329B45821219160784C829CE381B2EE2F6EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\package.json
Size 446B
SHA256 09821bc51af3fbc2d62169f528f0d0d8fe99f173bfc7fb2ffbb0f988bfabb407
MD5 9892e8e4423c1d8b94d646fc1a0578d0
SHA1 9a641eef5d590327664749e75facc2c403211d13
SHA512 1ca24980f1b7369d8ac0566877e4a5df83a106f14442ae7b8e49e5786a84880c7d445171692adbca79cb9bf2a332e18ac77080b66bec2d95f463b1027fa11eac
TLSH
T167F027CF48386CB90F3116D0E9AFAC4AC7391E4084D89C08C1EA5528807C55A534D96D
MD5 SHA1 SHA512 TLSH

Submit Download

registry.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\registry.node
Size 695KB
SHA256 a22a8111e94a1c174f046852cc8cfda9a391a7e432214f52378b456372ba4a8e
MD5 8c5b78ee81088415e075089e6da2e590
SHA1 9e0c9b84e40b9eaa16c21867f244688b43e210d1
SHA512 eb3668a1b15f6617649ebfc1412f3bc447de709a70f07a4f57db834be1d8538153440b44beb3260deca59805bcbea1073d77bb68d252e3e1d1d377502ebad31c
SSDEEP 12288:w7P4JLntTmvCGWJ19UOkhOXjpb277I74liAANjDaZrnOBi:nJLyAq2i
TLSH
T114E49F6677E81296E0B7D13EC9978F5AEAB1BC040720A7CB01D041A96F13BE85E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

renderer.css

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\renderer.css
Size 342KB
SHA256 a70593bc50fcdec89558c4f20a4728c41e6b9d3f03929398c3e3d70b27fd3c93
MD5 978d855e5114e6007e4dcabc4c5ace7d
SHA1 42b05037beaba5fa49c05fe3d02e9cbc65f7c5f4
SHA512 0a55d828db0e77a5fb952e16b30760402eb34508ba4c9dd28e952f9d9da678153e5172d6f13e043c886f65566a99a2ae97055c229ff6a56a65b93a48721b1a2c
SSDEEP 6144:FOgKGbmdV6iWfw7dOb9GfcyQhb228ytkUs5tsPLpM5U8zg+ySZu8Aj32IWnG5YFW:FOgKGbmdV6iWfw7dOb9GfcyQhb228yt7
TLSH
T1F67409A1E256F63F76375D3E2298F94C7309D491CD026BFEB215E08582CF7E43622989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

renderer.js

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\renderer.js
Size 3.0MB
SHA256 1cea63703b9a65374f2e85b847bf84c387fcf211694ed2661ecfd924ca7c237b
MD5 9a656ec3df6d135e65d267d8aed6a8c7
SHA1 f2d0531e95f463f2bb9d5b746e8d7f19fecc88df
SHA512 63f93a2dfd3e96e872f270b739833bb618183f744e67703fd6d8ae6969c5486795a09791895e3c04eb7fe64a584ce12d29a1878c2a34530106a04bad6d49db92
SSDEEP 49152:gxA2AJpgTTAfaDcYCgmKtyh6EW1y/CiApej0RrQkRWetpJ2bGW55e9TkGMmv1I+E:xyS3m9dM8E
TLSH
T1E8E54A9172A9606E46D78297D83A0411E33A586D345C406C767EEDEF78AE8C4E23FF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows-argv-parser.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\resources\app\windows-argv-parser.node
Size 176KB
SHA256 34c5b20fd34bea7c18bb2f4b58c8d57b9f60a4ca8679e66a8944fe2c1bf63a4f
MD5 1949363b4bd04c906c9e7bc730f0fe6e
SHA1 a02959e71c8005a64178108e5b0b75b65d3a6542
SHA512 7bb6db599568ab4db19995155fbf4a907379d2bc0e29cc743a5fde092cb18e7fb04bb8f333ebf84752a9aeef2f510943a32f88dd75311631e47caf00ec1246b9
SSDEEP 3072:4KpSuDO+UWLCP/lSw7+oEEbp/nrZVS9IdTG:Jq6L2vqE9GuNG
TLSH
T19A047E57B3B5007BE5B79639C9A34A42E772B91207A09BDF03A443751F233D19E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\squirrel.exe
Size 2.0MB
SHA256 2eae6547fd76725402be8489c4c627dc6885906041fb9f6f97f81ab1854bb94d
MD5 53c0ea7889e1c4511a724835673f149f
SHA1 efc9b5b7d31edb2efaa816bf30ac9b6a4b5daf1e
SHA512 fac77d19b5e6b4d7e8bc574e5b3212d8488ac9269472325237a0c6840c3249154657ee64c5841233869dc4b271cc006bc27fcf73e9fc1c91a7bfeccfafe8228d
SSDEEP 24576:VWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2g96v:Qt3UCiag6CKM2zCyZuOjJaxSS5qhpgK
TLSH
T104957C01E7E88F2BE5AF6776E030155813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.6.3\v8_context_snapshot.bin
Size 704KB
SHA256 a04efc1404d85595fb2c9c00268f6d49aee41cb63897ecb9ce5408a68dbb041f
MD5 c3d05cf39d1bc037f972f75244b4c04b
SHA1 7f450d2b750cf55dfbae7a6a62190800aa10e6b4
SHA512 049967ee513c026c83c43f157441bc7fc686c41303e3bf42998b4f21a2f0be2e3e8593e617d3e8a3e5614f6162002a1f40b65792fc5c13e35f2ea9662be463a9
SSDEEP 12288:D15XrgG4nwB2NdOeP8POqYUdEMH+jURWYS:D1n6C4H8POqYkEMH+AtS
TLSH
T19AE49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 84B
SHA256 4c3705caa952ed42331854996b0e6a3cbce16245269d914f94daa3f1e2d4caad
MD5 e958947971560a810b57e310e60f54bd
SHA1 715efd3b9c9a166a6e21477c0916b95cd675ae8d
SHA512 35e30d375a8a31a1b3b7ee19235ce9ff3a3a0b4a39a49f0cc7f4bdaddde07a5765b464abe720031458975d48f8485f224a8750ecee3c4b48ec4f208bd74fd46d
TLSH
T136A012CD003054DC6CAF400C101BC417C1710D0042F51578C190674D003048046D84D4
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 b6425409b446224f7874563719b19b423c2450250737dff6fe245824ce359f99
MD5 91b79010161544eb504e31f0cd203bf5
SHA1 6d33d4315493415ad126814048fc8e46b7d828df
SHA512 6639275fc2d3b8edf232be85b34c29a8df9ee3a41687a19041d079a72a254e012a94df5bc9f012ad0b9b8d3c969c4551a56a02db0bacf3f92be8cda9ecffecd5
SSDEEP 24576:1WltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2y:wt3UCiag6CKM2zCyZuOjJaxSS5qhq
TLSH
T1A4957C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 28KB
SHA256 f1b5abcae2553b087045362562f659f7def98edb1e003a1b4cb6f3a99dd5680e
MD5 1eb5b397a8a018b268cc40e6628af3b9
SHA1 d25a56d87af30360893d5a84909e206005b4259c
SHA512 3158da743f8b65c3f1af1111d28227bef3d71f9b20d42dd6f19a3123e7756c68018b0afb39975804b2f373e8da493155d9d8b0cc306d2c48f7bec5fa091a2adc
SSDEEP 768:UhQxkc6x6Xw0rD1QENdJb1Vomoq+h1hdrM/8206ZDW:udjuw0rD1QENdF1+P9fMDW
TLSH
T153D2E0BF6BE10E041429EA8C2E8363E9F497D12257CDE9826538153F54CC27BF92E6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 126KB
SHA256 88517264611cdd0ea5270be87edae52447ee043f8a45b3e87a4b7a9238375333
MD5 1839b2cdf7b9a3f589cf204afa588076
SHA1 cf24a4544ef3ef6f9969289b62cd99c6ceda616a
SHA512 cc4207306ac041f6794ae9b85a1d91c34a8ad8f504ede790414017447ef09312ef0e7812d04d028a54268109edd35c86356612a36048df2a79a8d70dd3229732
SSDEEP 1536:RZVb9dfF9IfffH9fffffHfffMfffPfffffYXfDGnyffIBwDKvkrkX/kkkVQk7aTw:RZVb9db6aTHJFIFE3sgc6AnpqB7Bxfnm
TLSH
T1BAC32BB375C280F5DAD4F5B87E94AC85E4F1FEAB50FC20382C6572E814A92F14563E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\Local State
Size 490B
SHA256 08e55511c187eb4e5d18fcab4f3a4ad2c814a1e9b5d64eb468b6da24f9ff1244
MD5 fd6e280cf9cb9309511e53b70f595fe9
SHA1 8322655c4687c0bdd624dfdcb78059887b452c13
SHA512 136cb47f3b7daa032403f6cf6c9964e0de8c2e019fa99258d1d38ccb5a775296190d86fb0ad0d5422dbcb940a3971c59ca7323a25fc544ede2331ecf5ab509b5
TLSH
T164F054F09C525BB97B428B44480B25060D261163548B17243AE61F4743ABA884107D34
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-30.desktop.production.log

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\logs\2026-07-30.desktop.production.log
Size 2KB
SHA256 2b2c1c054e5549120b90a571d54430cbbb38c25850abfbc25dea2a11fe8828a5
MD5 3424338e66d8a42e40fc3d1979517596
SHA1 3f247cb5fc23992fa21a78f84c9f2e2e63d740ba
SHA512 2a22ab31748917abda58ea10cf7e8b2620193b5934d2e24b311f31d8b2dad561c7ba5c37746795d226e8c88f57f9bd81f5f8e991480551790a49a9b59cacd0e6
TLSH
T1A251AD05407AD927183EE47BA074A59DC9E19C47AB8DFE84A22CC69D1BC7802FEE14CC
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

GitHub Desktop.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GitHub, Inc\GitHub Desktop.lnk
Size 2KB
SHA256 9b4fbd83d198665bea6f08935f6ccc234bb0917de3773f2bc3a0beb2555d4b13
MD5 eac6eeec51a75315fbfb537ae828f2fe
SHA1 2a5388c9045298cad2404a2199b4cd2c6488a7f2
SHA512 6442f726a1e25eaa7b9e8a1ffde1e44ff2dc0ddf578304a3adf3052cbe4521a9e433c455af74fd734bf99cba827305e46c27b9846b573137a23247879d35fe40
TLSH
T11B41791675EA2B32C3FBCB3897F36595D6797892A750CA0D0075824C0D95BC0EEA0F1B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/340-1414-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/340-1413-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/340-1415-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/340-1412-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/340-1417-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/340-1416-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/544-1373-0x00007FF7482A0000-0x00007FF7482F1000-memory.dmp

Download

memory/564-1371-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/564-1370-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/564-1368-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/564-1367-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/564-1369-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/564-1366-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/644-1372-0x00007FF7482A0000-0x00007FF7482F1000-memory.dmp

Download

memory/1256-1407-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/1256-1405-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/1256-1406-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/1256-1408-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/1256-1409-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/1256-1410-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/2384-1347-0x00007FF8754A0000-0x00007FF8755BE000-memory.dmp

Download

memory/2384-1346-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/2384-1348-0x00007FF88A3A0000-0x00007FF88A3F2000-memory.dmp

Download

memory/2384-1349-0x00007FF8753E0000-0x00007FF875496000-memory.dmp

Download

memory/2384-1350-0x00007FF884800000-0x00007FF884816000-memory.dmp

Download

memory/2384-1351-0x00007FF877AF0000-0x00007FF877B14000-memory.dmp

Download

memory/2396-1352-0x000000001DAD0000-0x000000001DFF8000-memory.dmp

Download

memory/2560-1428-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/3256-1389-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/3256-1394-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/3256-1390-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/3256-1391-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/3256-1392-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/3256-1393-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/3304-1425-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/3304-1423-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/3304-1422-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/3304-1424-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/3304-1426-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/3304-1421-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/3436-1377-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/3436-1376-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/3436-1380-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/3436-1375-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/3436-1378-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/3436-1379-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/3488-1353-0x00007FF7482A0000-0x00007FF7482F1000-memory.dmp

Download

memory/3524-1163-0x0000000000B40000-0x0000000000D36000-memory.dmp

Download

memory/4056-1397-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/4056-1401-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/4056-1396-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/4056-1398-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/4056-1399-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/4056-1400-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/4632-1359-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/4632-1360-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download

memory/4632-1361-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/4632-1362-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/4632-1363-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/4632-1364-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/4772-8-0x00000000005D0000-0x00000000007A6000-memory.dmp

Download

memory/4772-205-0x0000000022D00000-0x0000000022D38000-memory.dmp

Download

memory/4772-206-0x0000000022CD0000-0x0000000022CDE000-memory.dmp

Download

memory/4940-1198-0x0000000001870000-0x0000000001890000-memory.dmp

Download

memory/5016-1384-0x00007FF88B0D0000-0x00007FF88B122000-memory.dmp

Download

memory/5016-1387-0x00007FF88A520000-0x00007FF88A544000-memory.dmp

Download

memory/5016-1386-0x00007FF88B0B0000-0x00007FF88B0C6000-memory.dmp

Download

memory/5016-1385-0x00007FF87F480000-0x00007FF87F536000-memory.dmp

Download

memory/5016-1382-0x00007FF6D1C30000-0x00007FF6D2089000-memory.dmp

Download

memory/5016-1383-0x00007FF87F540000-0x00007FF87F65E000-memory.dmp

Download