5804e4661f3a752725a60a90cdb2b92d18db03a957167940ff4d9c85e558bb20

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ToX Free Utility NEW ERA.exe
Size 37.7MB
Sample260824-nas92sdb37
SHA256 5804e4661f3a752725a60a90cdb2b92d18db03a957167940ff4d9c85e558bb20
MD5 c2c80bfa0411b39ea8f404bfcf7caf0e
SHA1 a8f1413fd238946e9e908d42013961afd497a876
SHA512 4fa551cbf8498dda4c077b31f14cfd30dcfaac338c416df2a0a245c52cc1c9f65ac87c0f6da484208ae61a9815cf534e4affdf2049d075d38fdf7b969d1cae7e
SSDEEP 786432:hTnUeGx+qqZU7/EmbgB83AuPhyr11/rnru4RXc7OtrKI/qzkkEh:BnIhqZKEmOPx1/rg7OtrK4q
TLSH
T19887334033E8095AF2FF5FB9AEBA14808B767D96297AC49D04B854CD09B2F50CD61B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2128	takeown.exe
972	icacls.exe
4628	takeown.exe
5336	icacls.exe
5592	takeown.exe
3384	icacls.exe
3352	takeown.exe
2020	icacls.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2020	icacls.exe
2128	takeown.exe
972	icacls.exe
4628	takeown.exe
5336	icacls.exe
5592	takeown.exe
3384	icacls.exe
3352	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3188	powershell.exe
3752	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3968	powershell.exe
5084	powershell.exe
3752	powershell.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3068	sc.exe
2420	sc.exe
2024	sc.exe
1644	sc.exe
3752	sc.exe
2164	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToX Free Utility NEW ERA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ToX Free Utility NEW ERA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ToX Free Utility NEW ERA.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ToX Free Utility NEW ERA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ToX Free Utility NEW ERA.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
3656	taskkill.exe
1712	taskkill.exe
2296	taskkill.exe
4632	taskkill.exe
6060	taskkill.exe
1952	taskkill.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe
4752	ToX Free Utility NEW ERA.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	ToX Free Utility NEW ERA.exe
Token: SeDebugPrivilege	3656	taskkill.exe
Token: SeRestorePrivilege	1880	reg.exe
Token: SeRestorePrivilege	3188	reg.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	4428	svchost.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	1952	taskkill.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	3752	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2632	4752	ToX Free Utility NEW ERA.exe	93
PID 2632 wrote to memory of 3656	2632	cmd.exe	95
PID 2632 wrote to memory of 5756	2632	cmd.exe	96
PID 2632 wrote to memory of 952	2632	cmd.exe	97
PID 2632 wrote to memory of 1880	2632	cmd.exe	98
PID 2632 wrote to memory of 1744	2632	cmd.exe	99
PID 2632 wrote to memory of 3188	2632	cmd.exe	100
PID 2632 wrote to memory of 4628	2632	cmd.exe	101
PID 2632 wrote to memory of 5336	2632	cmd.exe	102
PID 2632 wrote to memory of 1712	2632	cmd.exe	103
PID 2632 wrote to memory of 2296	2632	cmd.exe	104
PID 2632 wrote to memory of 4632	2632	cmd.exe	105
PID 2632 wrote to memory of 3068	2632	cmd.exe	106
PID 2632 wrote to memory of 2420	2632	cmd.exe	107
PID 2632 wrote to memory of 2024	2632	cmd.exe	108
PID 2632 wrote to memory of 1644	2632	cmd.exe	109
PID 2632 wrote to memory of 3752	2632	cmd.exe	110
PID 2632 wrote to memory of 2164	2632	cmd.exe	111
PID 2632 wrote to memory of 3968	2632	cmd.exe	112
PID 2632 wrote to memory of 5084	2632	cmd.exe	118
PID 2632 wrote to memory of 3836	2632	cmd.exe	119
PID 2632 wrote to memory of 2844	2632	cmd.exe	120
PID 2632 wrote to memory of 2864	2632	cmd.exe	121
PID 2632 wrote to memory of 3756	2632	cmd.exe	122
PID 2632 wrote to memory of 1520	2632	cmd.exe	123
PID 2632 wrote to memory of 4500	2632	cmd.exe	124
PID 2632 wrote to memory of 4216	2632	cmd.exe	125
PID 2632 wrote to memory of 2936	2632	cmd.exe	126
PID 2632 wrote to memory of 700	2632	cmd.exe	127
PID 2632 wrote to memory of 5148	2632	cmd.exe	128
PID 2632 wrote to memory of 4940	2632	cmd.exe	129
PID 2632 wrote to memory of 5404	2632	cmd.exe	130
PID 2632 wrote to memory of 4700	2632	cmd.exe	131
PID 2632 wrote to memory of 5504	2632	cmd.exe	132
PID 2632 wrote to memory of 3376	2632	cmd.exe	133
PID 2632 wrote to memory of 2780	2632	cmd.exe	134
PID 2632 wrote to memory of 2400	2632	cmd.exe	135
PID 2632 wrote to memory of 4620	2632	cmd.exe	136
PID 2632 wrote to memory of 5592	2632	cmd.exe	137
PID 2632 wrote to memory of 3384	2632	cmd.exe	138
PID 2632 wrote to memory of 3352	2632	cmd.exe	139
PID 2632 wrote to memory of 2020	2632	cmd.exe	140
PID 2632 wrote to memory of 2128	2632	cmd.exe	141
PID 2632 wrote to memory of 972	2632	cmd.exe	142
PID 2632 wrote to memory of 6060	2632	cmd.exe	143
PID 2632 wrote to memory of 1952	2632	cmd.exe	144
PID 2632 wrote to memory of 3188	2632	cmd.exe	145
PID 2632 wrote to memory of 3752	2632	cmd.exe	148

C:\Users\Admin\AppData\Local\Temp\ToX Free Utility NEW ERA.exe
"C:\Users\Admin\AppData\Local\Temp\ToX Free Utility NEW ERA.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\ToXTweaks\BatchTweaks\WindowsTweaks_Debloat_Windows_apply_20260824_121313_460.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /F /IM "OneDrive.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5756
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCR\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:952
- - C:\Windows\SysWOW64\reg.exe
    reg load "hku\Default" "C:\Users\Default\NTUSER.DAT"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_USERS\Default\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1744
- - C:\Windows\SysWOW64\reg.exe
    reg unload "hku\Default"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy" /r /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4628
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy" /grant administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5336
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftEdgeUpdate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MicrosoftEdge*.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc stop edgeupdate
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Windows\SysWOW64\sc.exe
    sc delete edgeupdate
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Windows\SysWOW64\sc.exe
    sc stop edgeupdatem
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2024
- - C:\Windows\SysWOW64\sc.exe
    sc delete edgeupdatem
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1644
- - C:\Windows\SysWOW64\sc.exe
    sc stop MicrosoftEdgeElevationService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3752
- - C:\Windows\SysWOW64\sc.exe
    sc delete MicrosoftEdgeElevationService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2164
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -EP Bypass "Get-AppxPackage -AllUsers Microsoft.MicrosoftEdge.Stable* | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -EP Bypass "Get-AppxPackage -AllUsers Microsoft.MicrosoftEdgeDevToolsClient* | Remove-AppxPackage -AllUsers -ErrorAction SilentlyContinue"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarMigratedBrowserPin /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3836
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2844
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\MSEdgeHTM" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3756
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\MSEdgePDF" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1520
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\MSEdgeMHT" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4500
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4216
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\RegisteredApplications" /v "Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\SOFTWARE\RegisteredApplications" /v "Microsoft Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:700
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5148
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Edge" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v InstallDefault /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5404
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v UpdateDefault /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4700
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\EdgeUpdate" /v CreateDesktopShortcutDefault /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5504
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\EdgeUpdate" /v DoNotUpdateToEdgeWithChromium /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3376
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\OEM\MicrosoftEdge" /v AutoLaunchOnLogonBehavior /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\EdgeUI" /v DisableMFUTracking /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main" /v AllowPrelaunch /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Program Files (x86)\Microsoft\Edge" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5592
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Program Files (x86)\Microsoft\Edge" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Program Files (x86)\Microsoft\EdgeCore" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3352
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Program Files (x86)\Microsoft\EdgeCore" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Program Files (x86)\Microsoft\EdgeUpdate" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2128
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Program Files (x86)\Microsoft\EdgeUpdate" /grant Administrators:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msteams.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ms-teams.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-AppxPackage *Clipchamp.Clipchamp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ApplicationCompatibilityEnhancements* | Remove-AppxPackage; Get-AppxPackage *Microsoft.AV1VideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.AVCEncoderVideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingNews* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingSearch* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingWeather* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Copilot* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Edge.GameAssist* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Family* | Remove-AppxPackage; Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Getstarted* | Remove-AppxPackage; Get-AppxPackage *Microsoft.HEIFImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.HEVCVideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftEdge.Stable* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftOfficeHub* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MPEG2VideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.OneDriveSync* | Remove-AppxPackage; Get-AppxPackage *Microsoft.OutlookForWindows* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Paint* | Remove-AppxPackage; Get-AppxPackage *Microsoft.People* | Remove-AppxPackage; Get-AppxPackage *Microsoft.PowerAutomateDesktop* | Remove-AppxPackage; Get-AppxPackage *Microsoft.RawImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ScreenSketch* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Todos* | Remove-AppxPackage; Get-AppxPackage *Microsoft.VP9VideoExtensions* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WebMediaExtensions* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WebpImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsAlarms* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsCalculator* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsCamera* | Remove-AppxPackage; Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Windows.DevHome* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsMaps* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsNotepad* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Windows.Photos* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsSoundRecorder* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsTerminal* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Xbox.TCUI* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxGameOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxGamingOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxSpeechToTextOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.YourPhone* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ZuneMusic* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ZuneVideo* | Remove-AppxPackage; Get-AppxPackage *MicrosoftCorporationII.MicrosoftFamily* | Remove-AppxPackage; Get-AppxPackage *MicrosoftCorporationII.QuickAssist* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.CrossDevice* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.LKG.TwinSxS* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WidgetsPlatformRuntime* | Remove-AppxPackage; Get-AppxPackage *MSTeams* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.Client.WebExperience* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "if (-not (Get-Process explorer -ErrorAction SilentlyContinue)) { Start-Process explorer.exe -Verb RunAsUser }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3752

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4468

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe
1⤵
PID:200

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Edge.GameAssist_8wekyb3d8bbwe
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 7b3efdd2dfc4a2e29c2dca19496e991bcfce60e5a29b3eff802e4911839e3843
MD5 9fba0a88cd1b1500195d177296ebfe3b
SHA1 a54c8d45d8c902e216ddb433e7292a5fecdb9e7a
SHA512 d8ffe8cf72f6007f56bc37f1f8a1b607c88d6df69086a8880f04042934078a347610356535ceff9fe519be8d9ee1b4135a049c13dd1acdd5834c97619de4f644
SSDEEP 384:o1TB1GW1ivGW14b6zV3VeJNR+deUVxakXBNIAbz4f+5Wy+tzKwQvYbhNaqlGeDXK:kTOiHWiulVeLR+dZ9nIAbz8+kVPbhNa3
TLSH
T18182A7A9516F6DC7D8A122B014960DE7FBF4E48C9E3551D8FF27CE2B5C90EBA4B60120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 66db5da11596a3914d0daeb1876ddfb92136cb671952ca81236007269f65e882
MD5 a564e80dd6a707357a2eec9a0632c189
SHA1 febedf8e8b718a75cb53e33fc2b688046c96b255
SHA512 c6f93bf9c3f6ebf003f50f5974ee4e1ace9bb10c88c393ec42f1ccac9dbcf73f3a077b6108a22b298ee7a9659660efa8a51ba52d29dc78eb7b03e83a7c076496
SSDEEP 384:o1TBaGW1ieyVl4u0VhQ+geCed2PsMzdC0wIAbIIbkleoaqBUpxv2AeUJBeeCvoq7:kTni8VlH0VhQ+9oZC0wIAb+eoaMUoUJS
TLSH
T19692E61D32AF9CC7D4A121B454810B87EBF8E055A27091EBBE5BCA2FAC41E7D4B502F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 f303acaa26f86969e7239ad135975b70bf29344997e951aedaec7d60d0a573ea
MD5 ece21255bd319426d881f904d8a6ec37
SHA1 cc7a952fbe40d5aabb73c013271f2e0f9f363fd2
SHA512 3d7903832c4efa5970da086f2e7f6a5764fc78498f0f026df1a03d7baf1e054ea703d31b7628f1346ae6aa449d3087cd16f08fdfb2252868bbfa562087db0f5c
SSDEEP 384:r78mnGW1iSiRcFV/eVctme3vRdiUDzdC0tbIAWOIFNzQV9vOB3cvIhN/UJBGeuo6:rtGiJiRAV/e2tHvRkUFC0JIAbmRW9v4t
TLSH
T1FA82D74922AF9DCBD82120F414410F86FBF4D0599BA191DEFA9BCE2BAC41E7E5B501F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsTweaks_Debloat_Windows_apply_20260824_121313_460.bat

Path C:\Users\Admin\AppData\Local\Temp\ToXTweaks\BatchTweaks\WindowsTweaks_Debloat_Windows_apply_20260824_121313_460.bat
Size 8KB
SHA256 cd54c626e202c61b0dff0451ae2020edf99535daf23552be080746659281b6b2
MD5 e61644b92467df5cf1f32c86183e020c
SHA1 72e24cfd274edc99ce5a354bea9676f9dff12917
SHA512 96ff4c61804b381a5d1f98d01680a1b89dc956ad050de1e45fffe2ef013d400419cb42fec428d9fb05f8a00834788d2ffcffa6fc264908ad7bfd59b82fdf630a
SSDEEP 192:tyCptBAihW4QjguOXhJm5uG1FbFMuKndpYd+cwp1d+vCpfd+UTErLY+oT7WrPXCi:tyCptBAituOXhJm5uG1Fodpk+cwpP+v3
TLSH
T106025BA29BD2CF6285B87D4BA4EA885D368E6783F4425FF470C71080D5937E2C32B195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nwh2n2ld.rsy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nwh2n2ld.rsy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3188-134-0x0000000007710000-0x00000000077B3000-memory.dmp

Download

memory/3188-131-0x000000006EE20000-0x000000006EE6C000-memory.dmp

Download

memory/3188-129-0x0000000006500000-0x000000000654C000-memory.dmp

Download

memory/3188-127-0x0000000006030000-0x000000000638B000-memory.dmp

Download

memory/3752-136-0x0000000005F90000-0x00000000062EB000-memory.dmp

Download

memory/3752-140-0x0000000006AB0000-0x0000000006AFC000-memory.dmp

Download

memory/3752-141-0x00000000077B0000-0x0000000007846000-memory.dmp

Download

memory/3752-142-0x00000000069D0000-0x00000000069F2000-memory.dmp

Download

memory/3968-49-0x00000000071F0000-0x0000000007216000-memory.dmp

Download

memory/3968-41-0x0000000006EF0000-0x0000000006F0A000-memory.dmp

Download

memory/3968-50-0x0000000007230000-0x0000000007238000-memory.dmp

Download

memory/3968-48-0x0000000007180000-0x0000000007188000-memory.dmp

Download

memory/3968-45-0x0000000006130000-0x0000000006138000-memory.dmp

Download

memory/3968-47-0x0000000007140000-0x000000000714A000-memory.dmp

Download

memory/3968-46-0x0000000007130000-0x0000000007136000-memory.dmp

Download

memory/3968-44-0x00000000071C0000-0x00000000071EA000-memory.dmp

Download

memory/3968-42-0x00000000072C0000-0x00000000074C4000-memory.dmp

Download

memory/3968-43-0x0000000007110000-0x000000000712A000-memory.dmp

Download

memory/3968-24-0x00000000046A0000-0x00000000046D6000-memory.dmp

Download

memory/3968-25-0x0000000004DA0000-0x00000000053EA000-memory.dmp

Download

memory/3968-26-0x00000000053F0000-0x0000000005412000-memory.dmp

Download

memory/3968-27-0x0000000005490000-0x00000000054F6000-memory.dmp

Download

memory/3968-29-0x0000000005500000-0x0000000005566000-memory.dmp

Download

memory/3968-31-0x0000000005750000-0x0000000005AAB000-memory.dmp

Download

memory/3968-32-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Download

memory/3968-33-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Download

memory/3968-34-0x0000000006D20000-0x0000000006D56000-memory.dmp

Download

memory/3968-35-0x000000006EEB0000-0x000000006EEFC000-memory.dmp

Download

memory/3968-38-0x0000000006120000-0x0000000006140000-memory.dmp

Download

memory/3968-39-0x0000000006D60000-0x0000000006E03000-memory.dmp

Download

memory/3968-40-0x0000000007540000-0x0000000007BBC000-memory.dmp

Download

memory/4428-99-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-104-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-115-0x000001CC20310000-0x000001CC20311000-memory.dmp

Download

memory/4428-116-0x000001CC20310000-0x000001CC20311000-memory.dmp

Download

memory/4428-113-0x000001CC1E750000-0x000001CC1E751000-memory.dmp

Download

memory/4428-114-0x000001CC1E860000-0x000001CC1E861000-memory.dmp

Download

memory/4428-112-0x000001CC1E750000-0x000001CC1E751000-memory.dmp

Download

memory/4428-110-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-111-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-108-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-67-0x000001CC0E410000-0x000001CC0E420000-memory.dmp

Download

memory/4428-88-0x000001CC1E710000-0x000001CC1E711000-memory.dmp

Download

memory/4428-86-0x000001CC1E5D0000-0x000001CC1E5D1000-memory.dmp

Download

memory/4428-51-0x000001CC0BE90000-0x000001CC0BEA0000-memory.dmp

Download

memory/4428-95-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-97-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-107-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-98-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-96-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-94-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-93-0x000001CC1E730000-0x000001CC1E731000-memory.dmp

Download

memory/4428-92-0x000001CC1E720000-0x000001CC1E721000-memory.dmp

Download

memory/4428-91-0x000001CC1E720000-0x000001CC1E721000-memory.dmp

Download

memory/4428-100-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-101-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-90-0x000001CC1E710000-0x000001CC1E711000-memory.dmp

Download

memory/4428-102-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-109-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-103-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-105-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4428-106-0x000001CC1E740000-0x000001CC1E741000-memory.dmp

Download

memory/4752-6-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-18-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-15-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-0-0x00000000747E2000-0x00000000747E3000-memory.dmp

Download

memory/4752-16-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-17-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-11-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-19-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-20-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-21-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-14-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-12-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-130-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-10-0x00000000747E2000-0x00000000747E3000-memory.dmp

Download

memory/4752-9-0x000000000BC00000-0x000000000BC28000-memory.dmp

Download

memory/4752-8-0x000000000BB20000-0x000000000BB2A000-memory.dmp

Download

memory/4752-1-0x0000000000AA0000-0x000000000305E000-memory.dmp

Download

memory/4752-7-0x000000000BB30000-0x000000000BBF2000-memory.dmp

Download

memory/4752-13-0x00000000747D0000-0x0000000074F8C000-memory.dmp

Download

memory/4752-5-0x0000000007C60000-0x0000000007C6A000-memory.dmp

Download

memory/4752-4-0x0000000007BE0000-0x0000000007C46000-memory.dmp

Download

memory/4752-3-0x0000000007C80000-0x0000000007D12000-memory.dmp

Download

memory/4752-2-0x00000000081A0000-0x000000000875A000-memory.dmp

Download

memory/5084-121-0x000000006EEB0000-0x000000006EEFC000-memory.dmp

Download