8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa

Analysis

max time kernel
148s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
Size 1.5MB
Sample201109-af144ceeqj
SHA256 8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa
MD5 aad58eb80e1f0be04889d19202296208
SHA1 0c4b72bb5b16e1831826aa392354d348439dc732
SHA512 31cfaa3226ef4b0f67f5a4c71d6138fbd1bc22d2f519b6fbef76e81ba8b735925036c218ebadeed4a0a860c2e22b8ed56163d6af1dbb072c22cfcca93f96c00a
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 93 IoCs

pid	Process
2528	DouTuDaShi.exe
2388	nucxtr.exe
2632	nucxtr.exe
1504	654386.exe
4060	654386.exe
4072	370866.exe
3824	370866.exe
4704	170576.exe
4760	170576.exe
4520	532192.exe
4532	532192.exe
4432	461659.exe
4244	461659.exe
4596	850274.exe
4900	850274.exe
5080	975882.exe
5096	975882.exe
1560	799741.exe
4220	799741.exe
4884	117265.exe
4988	117265.exe
5072	644885.exe
4176	644885.exe
4472	862310.exe
3744	862310.exe
4896	670746.exe
3988	670746.exe
5064	999176.exe
5116	999176.exe
4468	526314.exe
3940	526314.exe
4640	530967.exe
4600	530967.exe
4504	489124.exe
188	489124.exe
1884	138185.exe
372	138185.exe
4568	239636.exe
4536	239636.exe
4756	251794.exe
4000	251794.exe
2464	204050.exe
4108	204050.exe
4956	274584.exe
4608	274584.exe
740	051118.exe
4864	051118.exe
3780	235199.exe
3680	235199.exe
4868	015745.exe
4644	015745.exe
4824	237001.exe
2516	237001.exe
4628	035336.exe
4388	035336.exe
4716	815960.exe
912	815960.exe
4584	037236.exe
676	037236.exe
1256	070394.exe
5092	070394.exe
2228	857928.exe
2244	857928.exe
4228	111029.exe
4216	111029.exe
4232	879818.exe
4280	879818.exe
4300	033719.exe
3704	033719.exe
4552	086077.exe
2052	086077.exe
4616	912896.exe
504	912896.exe
2468	086777.exe
3740	086777.exe
2224	856301.exe
4312	856301.exe
1696	853936.exe
4952	853936.exe
4996	876092.exe
4668	876092.exe
976	820370.exe
4792	820370.exe
4928	143435.exe
4832	143435.exe
200	920060.exe
4496	920060.exe
4544	710604.exe
3812	710604.exe
2540	943960.exe
2768	943960.exe
756	965026.exe
3288	965026.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DouTu\DouTuDaShi.exe	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	DouTuDaShi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DouTuDaShi.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "10796"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "10796"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "24691"	DouTuDaShi.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.cn	DouTuDaShi.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\NumberOfSubdomains = "1"	DouTuDaShi.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com	DouTuDaShi.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "25040"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "25040"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25165"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "25165"	DouTuDaShi.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\hao.360.com\ = "90"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "24691"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25040"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "25165"	DouTuDaShi.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.com\Total = "90"	DouTuDaShi.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "10796"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "24691"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\360.cn\NumberOfSubdomains = "1"	DouTuDaShi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "90"	DouTuDaShi.exe

Modifies registry class 154 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000dd1e3ad22df64156276c48650616cb51b5f4b03eb1c42523b21004edaef8a27fc4dc48b5765c3fd169595376fa9a65a95de2ad450deb666268fe	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000b49ddac4a695969cf63918eb59a9a25bbc46451e9aaa47e0f3ca7168e9858f61fd00d28ccd8be7244ef7ffb5a090b9c1ef303fbf370d900889420339b43d0bca3079a68ef54235f8d0713506703710001e8e80e3bff3040331ec	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "blzcacx"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "5"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 46ee363fcdb7d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f10b903ecdb7d601	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{8F66BAE7-3FE1-4A87-8C39-450D718AF871}"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{9CB27462-8D10-4153-A112-C2A8F667FB07}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{90088AF7-729C-4B88-8347-A7D3A874F001} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000024ca21a956d0de5c3a48e6898939446b2c563d8a493cc9aee3d5af1c53258de017e3814b49a48e07756d5936b4ee9032c3d55e58b7dc593ddd935551280b303b83d12483c1f99cfb8f0d66401f2d7f4495bad4ebaa4e0623c3de77dfaf49577ebeb470f28a6f5600174b6b40c194ea0d8024375c4331beeefad6c490d581d9e644ad9b0cf7a6213cde451dbd29c570f14833a2f7eb24e7606b9ca82ada5249158dda7b32513f64de1d1d2bc3a75ee54223073044d6c9ee5d394ece94e15c628ce35c871d6ad802dad9f1fb8b9f00fbd699bfe1567dbf68f23f0d52d2bc3fa4d02d54c89d2d12efb034e3e145244c4b21e17d5775e3a5e1621af92ac9759b130a64e09ba5978da44cfe1148f2bde0f3e41860ec0cb11d33510d323bdd2a108e3b8221c9a5d6e974e9e19d0728525e7c6e5d88abf540c630ec4bd81156263e8c0acb37a23adac61e127da61a26f8649f669b148a078f3f9f34400bd2995ec505131a43e52940c59eaadb4b78b37a945e31a52692ffe62aa74e48eb1f326745e5d0f7634eab4284cf077daed4cc148cabd68addaab2252696e338cc61dabe721658ba8f282c6cc0	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b2b1f23dcdb7d601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	DouTuDaShi.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	DouTuDaShi.exe

Suspicious behavior: EnumeratesProcesses 98 IoCs

pid	Process
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe
2632	nucxtr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4792	MicrosoftEdgeCP.exe
4792	MicrosoftEdgeCP.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	200	MicrosoftEdge.exe
Token: SeDebugPrivilege	200	MicrosoftEdge.exe
Token: SeDebugPrivilege	200	MicrosoftEdge.exe
Token: SeDebugPrivilege	200	MicrosoftEdge.exe
Token: SeDebugPrivilege	4856	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4856	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4856	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4856	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2528	DouTuDaShi.exe
2528	DouTuDaShi.exe
2528	DouTuDaShi.exe
2528	DouTuDaShi.exe
200	MicrosoftEdge.exe
2528	DouTuDaShi.exe
4792	MicrosoftEdgeCP.exe
4792	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 283 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2528	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	76
PID 744 wrote to memory of 2528	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	76
PID 744 wrote to memory of 2528	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	76
PID 744 wrote to memory of 2388	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	77
PID 744 wrote to memory of 2388	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	77
PID 744 wrote to memory of 2388	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	77
PID 2388 wrote to memory of 2632	2388	nucxtr.exe	78
PID 2388 wrote to memory of 2632	2388	nucxtr.exe	78
PID 2388 wrote to memory of 2632	2388	nucxtr.exe	78
PID 2632 wrote to memory of 1504	2632	nucxtr.exe	79
PID 2632 wrote to memory of 1504	2632	nucxtr.exe	79
PID 2632 wrote to memory of 1504	2632	nucxtr.exe	79
PID 1504 wrote to memory of 4060	1504	654386.exe	80
PID 1504 wrote to memory of 4060	1504	654386.exe	80
PID 1504 wrote to memory of 4060	1504	654386.exe	80
PID 2632 wrote to memory of 4072	2632	nucxtr.exe	81
PID 2632 wrote to memory of 4072	2632	nucxtr.exe	81
PID 2632 wrote to memory of 4072	2632	nucxtr.exe	81
PID 4072 wrote to memory of 3824	4072	370866.exe	82
PID 4072 wrote to memory of 3824	4072	370866.exe	82
PID 4072 wrote to memory of 3824	4072	370866.exe	82
PID 744 wrote to memory of 4168	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	86
PID 744 wrote to memory of 4168	744	8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe	86
PID 4252 wrote to memory of 4384	4252	explorer.exe	88
PID 4252 wrote to memory of 4384	4252	explorer.exe	88
PID 2632 wrote to memory of 4704	2632	nucxtr.exe	91
PID 2632 wrote to memory of 4704	2632	nucxtr.exe	91
PID 2632 wrote to memory of 4704	2632	nucxtr.exe	91
PID 4704 wrote to memory of 4760	4704	170576.exe	92
PID 4704 wrote to memory of 4760	4704	170576.exe	92
PID 4704 wrote to memory of 4760	4704	170576.exe	92
PID 2632 wrote to memory of 4520	2632	nucxtr.exe	95
PID 2632 wrote to memory of 4520	2632	nucxtr.exe	95
PID 2632 wrote to memory of 4520	2632	nucxtr.exe	95
PID 4520 wrote to memory of 4532	4520	532192.exe	96
PID 4520 wrote to memory of 4532	4520	532192.exe	96
PID 4520 wrote to memory of 4532	4520	532192.exe	96
PID 2632 wrote to memory of 4432	2632	nucxtr.exe	100
PID 2632 wrote to memory of 4432	2632	nucxtr.exe	100
PID 2632 wrote to memory of 4432	2632	nucxtr.exe	100
PID 4432 wrote to memory of 4244	4432	461659.exe	101
PID 4432 wrote to memory of 4244	4432	461659.exe	101
PID 4432 wrote to memory of 4244	4432	461659.exe	101
PID 2632 wrote to memory of 4596	2632	nucxtr.exe	102
PID 2632 wrote to memory of 4596	2632	nucxtr.exe	102
PID 2632 wrote to memory of 4596	2632	nucxtr.exe	102
PID 4596 wrote to memory of 4900	4596	850274.exe	103
PID 4596 wrote to memory of 4900	4596	850274.exe	103
PID 4596 wrote to memory of 4900	4596	850274.exe	103
PID 2632 wrote to memory of 5080	2632	nucxtr.exe	104
PID 2632 wrote to memory of 5080	2632	nucxtr.exe	104
PID 2632 wrote to memory of 5080	2632	nucxtr.exe	104
PID 5080 wrote to memory of 5096	5080	975882.exe	105
PID 5080 wrote to memory of 5096	5080	975882.exe	105
PID 5080 wrote to memory of 5096	5080	975882.exe	105
PID 2632 wrote to memory of 1560	2632	nucxtr.exe	106
PID 2632 wrote to memory of 1560	2632	nucxtr.exe	106
PID 2632 wrote to memory of 1560	2632	nucxtr.exe	106
PID 1560 wrote to memory of 4220	1560	799741.exe	107
PID 1560 wrote to memory of 4220	1560	799741.exe	107
PID 1560 wrote to memory of 4220	1560	799741.exe	107
PID 2632 wrote to memory of 4884	2632	nucxtr.exe	108
PID 2632 wrote to memory of 4884	2632	nucxtr.exe	108
PID 2632 wrote to memory of 4884	2632	nucxtr.exe	108
PID 4884 wrote to memory of 4988	4884	117265.exe	109
PID 4884 wrote to memory of 4988	4884	117265.exe	109
PID 4884 wrote to memory of 4988	4884	117265.exe	109
PID 2632 wrote to memory of 5072	2632	nucxtr.exe	110
PID 2632 wrote to memory of 5072	2632	nucxtr.exe	110
PID 2632 wrote to memory of 5072	2632	nucxtr.exe	110
PID 5072 wrote to memory of 4176	5072	644885.exe	111
PID 5072 wrote to memory of 4176	5072	644885.exe	111
PID 5072 wrote to memory of 4176	5072	644885.exe	111
PID 2632 wrote to memory of 4472	2632	nucxtr.exe	112
PID 2632 wrote to memory of 4472	2632	nucxtr.exe	112
PID 2632 wrote to memory of 4472	2632	nucxtr.exe	112
PID 4472 wrote to memory of 3744	4472	862310.exe	113
PID 4472 wrote to memory of 3744	4472	862310.exe	113
PID 4472 wrote to memory of 3744	4472	862310.exe	113
PID 2632 wrote to memory of 4896	2632	nucxtr.exe	114
PID 2632 wrote to memory of 4896	2632	nucxtr.exe	114
PID 2632 wrote to memory of 4896	2632	nucxtr.exe	114
PID 4896 wrote to memory of 3988	4896	670746.exe	115
PID 4896 wrote to memory of 3988	4896	670746.exe	115
PID 4896 wrote to memory of 3988	4896	670746.exe	115
PID 2632 wrote to memory of 5064	2632	nucxtr.exe	116
PID 2632 wrote to memory of 5064	2632	nucxtr.exe	116
PID 2632 wrote to memory of 5064	2632	nucxtr.exe	116
PID 5064 wrote to memory of 5116	5064	999176.exe	117
PID 5064 wrote to memory of 5116	5064	999176.exe	117
PID 5064 wrote to memory of 5116	5064	999176.exe	117
PID 2632 wrote to memory of 4468	2632	nucxtr.exe	118
PID 2632 wrote to memory of 4468	2632	nucxtr.exe	118
PID 2632 wrote to memory of 4468	2632	nucxtr.exe	118
PID 4468 wrote to memory of 3940	4468	526314.exe	119
PID 4468 wrote to memory of 3940	4468	526314.exe	119
PID 4468 wrote to memory of 3940	4468	526314.exe	119
PID 2632 wrote to memory of 4640	2632	nucxtr.exe	120
PID 2632 wrote to memory of 4640	2632	nucxtr.exe	120
PID 2632 wrote to memory of 4640	2632	nucxtr.exe	120
PID 4640 wrote to memory of 4600	4640	530967.exe	121
PID 4640 wrote to memory of 4600	4640	530967.exe	121
PID 4640 wrote to memory of 4600	4640	530967.exe	121
PID 2632 wrote to memory of 4504	2632	nucxtr.exe	122
PID 2632 wrote to memory of 4504	2632	nucxtr.exe	122
PID 2632 wrote to memory of 4504	2632	nucxtr.exe	122
PID 4504 wrote to memory of 188	4504	489124.exe	123
PID 4504 wrote to memory of 188	4504	489124.exe	123
PID 4504 wrote to memory of 188	4504	489124.exe	123
PID 2632 wrote to memory of 1884	2632	nucxtr.exe	124
PID 2632 wrote to memory of 1884	2632	nucxtr.exe	124
PID 2632 wrote to memory of 1884	2632	nucxtr.exe	124
PID 1884 wrote to memory of 372	1884	138185.exe	125
PID 1884 wrote to memory of 372	1884	138185.exe	125
PID 1884 wrote to memory of 372	1884	138185.exe	125
PID 2632 wrote to memory of 4568	2632	nucxtr.exe	126
PID 2632 wrote to memory of 4568	2632	nucxtr.exe	126
PID 2632 wrote to memory of 4568	2632	nucxtr.exe	126
PID 4568 wrote to memory of 4536	4568	239636.exe	127
PID 4568 wrote to memory of 4536	4568	239636.exe	127
PID 4568 wrote to memory of 4536	4568	239636.exe	127
PID 2632 wrote to memory of 4756	2632	nucxtr.exe	128
PID 2632 wrote to memory of 4756	2632	nucxtr.exe	128
PID 2632 wrote to memory of 4756	2632	nucxtr.exe	128
PID 4756 wrote to memory of 4000	4756	251794.exe	129
PID 4756 wrote to memory of 4000	4756	251794.exe	129
PID 4756 wrote to memory of 4000	4756	251794.exe	129
PID 2632 wrote to memory of 2464	2632	nucxtr.exe	130
PID 2632 wrote to memory of 2464	2632	nucxtr.exe	130
PID 2632 wrote to memory of 2464	2632	nucxtr.exe	130
PID 2464 wrote to memory of 4108	2464	204050.exe	131
PID 2464 wrote to memory of 4108	2464	204050.exe	131
PID 2464 wrote to memory of 4108	2464	204050.exe	131
PID 2632 wrote to memory of 4956	2632	nucxtr.exe	132
PID 2632 wrote to memory of 4956	2632	nucxtr.exe	132
PID 2632 wrote to memory of 4956	2632	nucxtr.exe	132
PID 4956 wrote to memory of 4608	4956	274584.exe	133
PID 4956 wrote to memory of 4608	4956	274584.exe	133
PID 4956 wrote to memory of 4608	4956	274584.exe	133
PID 2632 wrote to memory of 740	2632	nucxtr.exe	134
PID 2632 wrote to memory of 740	2632	nucxtr.exe	134
PID 2632 wrote to memory of 740	2632	nucxtr.exe	134
PID 740 wrote to memory of 4864	740	051118.exe	135
PID 740 wrote to memory of 4864	740	051118.exe	135
PID 740 wrote to memory of 4864	740	051118.exe	135
PID 2632 wrote to memory of 3780	2632	nucxtr.exe	136
PID 2632 wrote to memory of 3780	2632	nucxtr.exe	136
PID 2632 wrote to memory of 3780	2632	nucxtr.exe	136
PID 3780 wrote to memory of 3680	3780	235199.exe	137
PID 3780 wrote to memory of 3680	3780	235199.exe	137
PID 3780 wrote to memory of 3680	3780	235199.exe	137
PID 2632 wrote to memory of 4868	2632	nucxtr.exe	138
PID 2632 wrote to memory of 4868	2632	nucxtr.exe	138
PID 2632 wrote to memory of 4868	2632	nucxtr.exe	138
PID 4868 wrote to memory of 4644	4868	015745.exe	139
PID 4868 wrote to memory of 4644	4868	015745.exe	139
PID 4868 wrote to memory of 4644	4868	015745.exe	139
PID 2632 wrote to memory of 4824	2632	nucxtr.exe	140
PID 2632 wrote to memory of 4824	2632	nucxtr.exe	140
PID 2632 wrote to memory of 4824	2632	nucxtr.exe	140
PID 4824 wrote to memory of 2516	4824	237001.exe	141
PID 4824 wrote to memory of 2516	4824	237001.exe	141
PID 4824 wrote to memory of 2516	4824	237001.exe	141
PID 2632 wrote to memory of 4628	2632	nucxtr.exe	142
PID 2632 wrote to memory of 4628	2632	nucxtr.exe	142
PID 2632 wrote to memory of 4628	2632	nucxtr.exe	142
PID 4628 wrote to memory of 4388	4628	035336.exe	143
PID 4628 wrote to memory of 4388	4628	035336.exe	143
PID 4628 wrote to memory of 4388	4628	035336.exe	143
PID 2632 wrote to memory of 4716	2632	nucxtr.exe	144
PID 2632 wrote to memory of 4716	2632	nucxtr.exe	144
PID 2632 wrote to memory of 4716	2632	nucxtr.exe	144
PID 4716 wrote to memory of 912	4716	815960.exe	145
PID 4716 wrote to memory of 912	4716	815960.exe	145
PID 4716 wrote to memory of 912	4716	815960.exe	145
PID 2632 wrote to memory of 4584	2632	nucxtr.exe	146
PID 2632 wrote to memory of 4584	2632	nucxtr.exe	146
PID 2632 wrote to memory of 4584	2632	nucxtr.exe	146
PID 4584 wrote to memory of 676	4584	037236.exe	147
PID 4584 wrote to memory of 676	4584	037236.exe	147
PID 4584 wrote to memory of 676	4584	037236.exe	147
PID 2632 wrote to memory of 1256	2632	nucxtr.exe	148
PID 2632 wrote to memory of 1256	2632	nucxtr.exe	148
PID 2632 wrote to memory of 1256	2632	nucxtr.exe	148
PID 1256 wrote to memory of 5092	1256	070394.exe	149
PID 1256 wrote to memory of 5092	1256	070394.exe	149
PID 1256 wrote to memory of 5092	1256	070394.exe	149
PID 2632 wrote to memory of 2228	2632	nucxtr.exe	150
PID 2632 wrote to memory of 2228	2632	nucxtr.exe	150
PID 2632 wrote to memory of 2228	2632	nucxtr.exe	150
PID 2228 wrote to memory of 2244	2228	857928.exe	151
PID 2228 wrote to memory of 2244	2228	857928.exe	151
PID 2228 wrote to memory of 2244	2228	857928.exe	151
PID 2632 wrote to memory of 4228	2632	nucxtr.exe	152
PID 2632 wrote to memory of 4228	2632	nucxtr.exe	152
PID 2632 wrote to memory of 4228	2632	nucxtr.exe	152
PID 4228 wrote to memory of 4216	4228	111029.exe	153
PID 4228 wrote to memory of 4216	4228	111029.exe	153
PID 4228 wrote to memory of 4216	4228	111029.exe	153
PID 2632 wrote to memory of 4232	2632	nucxtr.exe	154
PID 2632 wrote to memory of 4232	2632	nucxtr.exe	154
PID 2632 wrote to memory of 4232	2632	nucxtr.exe	154
PID 4232 wrote to memory of 4280	4232	879818.exe	155
PID 4232 wrote to memory of 4280	4232	879818.exe	155
PID 4232 wrote to memory of 4280	4232	879818.exe	155
PID 2632 wrote to memory of 4300	2632	nucxtr.exe	156
PID 2632 wrote to memory of 4300	2632	nucxtr.exe	156
PID 2632 wrote to memory of 4300	2632	nucxtr.exe	156
PID 4300 wrote to memory of 3704	4300	033719.exe	157
PID 4300 wrote to memory of 3704	4300	033719.exe	157
PID 4300 wrote to memory of 3704	4300	033719.exe	157
PID 2632 wrote to memory of 4552	2632	nucxtr.exe	158
PID 2632 wrote to memory of 4552	2632	nucxtr.exe	158
PID 2632 wrote to memory of 4552	2632	nucxtr.exe	158
PID 4552 wrote to memory of 2052	4552	086077.exe	159
PID 4552 wrote to memory of 2052	4552	086077.exe	159
PID 4552 wrote to memory of 2052	4552	086077.exe	159
PID 2632 wrote to memory of 4616	2632	nucxtr.exe	160
PID 2632 wrote to memory of 4616	2632	nucxtr.exe	160
PID 2632 wrote to memory of 4616	2632	nucxtr.exe	160
PID 4616 wrote to memory of 504	4616	912896.exe	161
PID 4616 wrote to memory of 504	4616	912896.exe	161
PID 4616 wrote to memory of 504	4616	912896.exe	161
PID 2632 wrote to memory of 2468	2632	nucxtr.exe	162
PID 2632 wrote to memory of 2468	2632	nucxtr.exe	162
PID 2632 wrote to memory of 2468	2632	nucxtr.exe	162
PID 2468 wrote to memory of 3740	2468	086777.exe	163
PID 2468 wrote to memory of 3740	2468	086777.exe	163
PID 2468 wrote to memory of 3740	2468	086777.exe	163
PID 2632 wrote to memory of 2224	2632	nucxtr.exe	164
PID 2632 wrote to memory of 2224	2632	nucxtr.exe	164
PID 2632 wrote to memory of 2224	2632	nucxtr.exe	164
PID 2224 wrote to memory of 4312	2224	856301.exe	165
PID 2224 wrote to memory of 4312	2224	856301.exe	165
PID 2224 wrote to memory of 4312	2224	856301.exe	165
PID 2632 wrote to memory of 1696	2632	nucxtr.exe	166
PID 2632 wrote to memory of 1696	2632	nucxtr.exe	166
PID 2632 wrote to memory of 1696	2632	nucxtr.exe	166
PID 1696 wrote to memory of 4952	1696	853936.exe	167
PID 1696 wrote to memory of 4952	1696	853936.exe	167
PID 1696 wrote to memory of 4952	1696	853936.exe	167
PID 2632 wrote to memory of 4996	2632	nucxtr.exe	168
PID 2632 wrote to memory of 4996	2632	nucxtr.exe	168
PID 2632 wrote to memory of 4996	2632	nucxtr.exe	168
PID 4996 wrote to memory of 4668	4996	876092.exe	169
PID 4996 wrote to memory of 4668	4996	876092.exe	169
PID 4996 wrote to memory of 4668	4996	876092.exe	169
PID 2632 wrote to memory of 976	2632	nucxtr.exe	170
PID 2632 wrote to memory of 976	2632	nucxtr.exe	170
PID 2632 wrote to memory of 976	2632	nucxtr.exe	170
PID 976 wrote to memory of 4792	976	820370.exe	171
PID 976 wrote to memory of 4792	976	820370.exe	171
PID 976 wrote to memory of 4792	976	820370.exe	171
PID 2632 wrote to memory of 4928	2632	nucxtr.exe	172
PID 2632 wrote to memory of 4928	2632	nucxtr.exe	172
PID 2632 wrote to memory of 4928	2632	nucxtr.exe	172
PID 4928 wrote to memory of 4832	4928	143435.exe	173
PID 4928 wrote to memory of 4832	4928	143435.exe	173
PID 4928 wrote to memory of 4832	4928	143435.exe	173
PID 2632 wrote to memory of 200	2632	nucxtr.exe	174
PID 2632 wrote to memory of 200	2632	nucxtr.exe	174
PID 2632 wrote to memory of 200	2632	nucxtr.exe	174
PID 200 wrote to memory of 4496	200	920060.exe	175
PID 200 wrote to memory of 4496	200	920060.exe	175
PID 200 wrote to memory of 4496	200	920060.exe	175
PID 2632 wrote to memory of 4544	2632	nucxtr.exe	176
PID 2632 wrote to memory of 4544	2632	nucxtr.exe	176
PID 2632 wrote to memory of 4544	2632	nucxtr.exe	176
PID 4544 wrote to memory of 3812	4544	710604.exe	177
PID 4544 wrote to memory of 3812	4544	710604.exe	177
PID 4544 wrote to memory of 3812	4544	710604.exe	177
PID 2632 wrote to memory of 2540	2632	nucxtr.exe	178
PID 2632 wrote to memory of 2540	2632	nucxtr.exe	178
PID 2632 wrote to memory of 2540	2632	nucxtr.exe	178
PID 2540 wrote to memory of 2768	2540	943960.exe	179
PID 2540 wrote to memory of 2768	2540	943960.exe	179
PID 2540 wrote to memory of 2768	2540	943960.exe	179
PID 2632 wrote to memory of 756	2632	nucxtr.exe	180
PID 2632 wrote to memory of 756	2632	nucxtr.exe	180
PID 2632 wrote to memory of 756	2632	nucxtr.exe	180
PID 756 wrote to memory of 3288	756	965026.exe	181
PID 756 wrote to memory of 3288	756	965026.exe	181
PID 756 wrote to memory of 3288	756	965026.exe	181

C:\Users\Admin\AppData\Local\Temp\8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe
"C:\Users\Admin\AppData\Local\Temp\8abec65ae164e9b277cdddba8cb63034e1c9ea1971b27973560c77f37c7a4daa.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\DouTu\DouTuDaShi.exe
  "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\nucxtr.exe
  "C:\Users\Admin\AppData\Local\Temp\nucxtr.exe" /jscxyxztjkl
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Users\Admin\AppData\Local\Temp\nucxtr.exe
    "C:\Users\Admin\AppData\Local\Temp\nucxtr.exe" /jsjczxztcq
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Roaming\Download\654386.exe
      "C:\Users\Admin\AppData\Roaming\Download\654386.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Roaming\Download\654386.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\654386.exe"
        5⤵
        Executes dropped EXE
        
        PID:4060
  - - C:\Users\Admin\AppData\Roaming\Download\370866.exe
      "C:\Users\Admin\AppData\Roaming\Download\370866.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Users\Admin\AppData\Roaming\Download\370866.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\370866.exe"
        5⤵
        Executes dropped EXE
        
        PID:3824
  - - C:\Users\Admin\AppData\Roaming\Download\170576.exe
      "C:\Users\Admin\AppData\Roaming\Download\170576.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Users\Admin\AppData\Roaming\Download\170576.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\170576.exe"
        5⤵
        Executes dropped EXE
        
        PID:4760
  - - C:\Users\Admin\AppData\Roaming\Download\532192.exe
      "C:\Users\Admin\AppData\Roaming\Download\532192.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Users\Admin\AppData\Roaming\Download\532192.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\532192.exe"
        5⤵
        Executes dropped EXE
        
        PID:4532
  - - C:\Users\Admin\AppData\Roaming\Download\461659.exe
      "C:\Users\Admin\AppData\Roaming\Download\461659.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Users\Admin\AppData\Roaming\Download\461659.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\461659.exe"
        5⤵
        Executes dropped EXE
        
        PID:4244
  - - C:\Users\Admin\AppData\Roaming\Download\850274.exe
      "C:\Users\Admin\AppData\Roaming\Download\850274.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Users\Admin\AppData\Roaming\Download\850274.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\850274.exe"
        5⤵
        Executes dropped EXE
        
        PID:4900
  - - C:\Users\Admin\AppData\Roaming\Download\975882.exe
      "C:\Users\Admin\AppData\Roaming\Download\975882.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Users\Admin\AppData\Roaming\Download\975882.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\975882.exe"
        5⤵
        Executes dropped EXE
        
        PID:5096
  - - C:\Users\Admin\AppData\Roaming\Download\799741.exe
      "C:\Users\Admin\AppData\Roaming\Download\799741.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Users\Admin\AppData\Roaming\Download\799741.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\799741.exe"
        5⤵
        Executes dropped EXE
        
        PID:4220
  - - C:\Users\Admin\AppData\Roaming\Download\117265.exe
      "C:\Users\Admin\AppData\Roaming\Download\117265.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4884
    - - C:\Users\Admin\AppData\Roaming\Download\117265.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\117265.exe"
        5⤵
        Executes dropped EXE
        
        PID:4988
  - - C:\Users\Admin\AppData\Roaming\Download\644885.exe
      "C:\Users\Admin\AppData\Roaming\Download\644885.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:5072
    - - C:\Users\Admin\AppData\Roaming\Download\644885.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\644885.exe"
        5⤵
        Executes dropped EXE
        
        PID:4176
  - - C:\Users\Admin\AppData\Roaming\Download\862310.exe
      "C:\Users\Admin\AppData\Roaming\Download\862310.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4472
    - - C:\Users\Admin\AppData\Roaming\Download\862310.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\862310.exe"
        5⤵
        Executes dropped EXE
        
        PID:3744
  - - C:\Users\Admin\AppData\Roaming\Download\670746.exe
      "C:\Users\Admin\AppData\Roaming\Download\670746.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4896
    - - C:\Users\Admin\AppData\Roaming\Download\670746.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\670746.exe"
        5⤵
        Executes dropped EXE
        
        PID:3988
  - - C:\Users\Admin\AppData\Roaming\Download\999176.exe
      "C:\Users\Admin\AppData\Roaming\Download\999176.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:5064
    - - C:\Users\Admin\AppData\Roaming\Download\999176.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\999176.exe"
        5⤵
        Executes dropped EXE
        
        PID:5116
  - - C:\Users\Admin\AppData\Roaming\Download\526314.exe
      "C:\Users\Admin\AppData\Roaming\Download\526314.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4468
    - - C:\Users\Admin\AppData\Roaming\Download\526314.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\526314.exe"
        5⤵
        Executes dropped EXE
        
        PID:3940
  - - C:\Users\Admin\AppData\Roaming\Download\530967.exe
      "C:\Users\Admin\AppData\Roaming\Download\530967.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4640
    - - C:\Users\Admin\AppData\Roaming\Download\530967.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\530967.exe"
        5⤵
        Executes dropped EXE
        
        PID:4600
  - - C:\Users\Admin\AppData\Roaming\Download\489124.exe
      "C:\Users\Admin\AppData\Roaming\Download\489124.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4504
    - - C:\Users\Admin\AppData\Roaming\Download\489124.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\489124.exe"
        5⤵
        Executes dropped EXE
        
        PID:188
  - - C:\Users\Admin\AppData\Roaming\Download\138185.exe
      "C:\Users\Admin\AppData\Roaming\Download\138185.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:1884
    - - C:\Users\Admin\AppData\Roaming\Download\138185.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\138185.exe"
        5⤵
        Executes dropped EXE
        
        PID:372
  - - C:\Users\Admin\AppData\Roaming\Download\239636.exe
      "C:\Users\Admin\AppData\Roaming\Download\239636.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4568
    - - C:\Users\Admin\AppData\Roaming\Download\239636.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\239636.exe"
        5⤵
        Executes dropped EXE
        
        PID:4536
  - - C:\Users\Admin\AppData\Roaming\Download\251794.exe
      "C:\Users\Admin\AppData\Roaming\Download\251794.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4756
    - - C:\Users\Admin\AppData\Roaming\Download\251794.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\251794.exe"
        5⤵
        Executes dropped EXE
        
        PID:4000
  - - C:\Users\Admin\AppData\Roaming\Download\204050.exe
      "C:\Users\Admin\AppData\Roaming\Download\204050.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:2464
    - - C:\Users\Admin\AppData\Roaming\Download\204050.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\204050.exe"
        5⤵
        Executes dropped EXE
        
        PID:4108
  - - C:\Users\Admin\AppData\Roaming\Download\274584.exe
      "C:\Users\Admin\AppData\Roaming\Download\274584.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4956
    - - C:\Users\Admin\AppData\Roaming\Download\274584.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\274584.exe"
        5⤵
        Executes dropped EXE
        
        PID:4608
  - - C:\Users\Admin\AppData\Roaming\Download\051118.exe
      "C:\Users\Admin\AppData\Roaming\Download\051118.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:740
    - - C:\Users\Admin\AppData\Roaming\Download\051118.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\051118.exe"
        5⤵
        Executes dropped EXE
        
        PID:4864
  - - C:\Users\Admin\AppData\Roaming\Download\235199.exe
      "C:\Users\Admin\AppData\Roaming\Download\235199.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:3780
    - - C:\Users\Admin\AppData\Roaming\Download\235199.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\235199.exe"
        5⤵
        Executes dropped EXE
        
        PID:3680
  - - C:\Users\Admin\AppData\Roaming\Download\015745.exe
      "C:\Users\Admin\AppData\Roaming\Download\015745.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4868
    - - C:\Users\Admin\AppData\Roaming\Download\015745.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\015745.exe"
        5⤵
        Executes dropped EXE
        
        PID:4644
  - - C:\Users\Admin\AppData\Roaming\Download\237001.exe
      "C:\Users\Admin\AppData\Roaming\Download\237001.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4824
    - - C:\Users\Admin\AppData\Roaming\Download\237001.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\237001.exe"
        5⤵
        Executes dropped EXE
        
        PID:2516
  - - C:\Users\Admin\AppData\Roaming\Download\035336.exe
      "C:\Users\Admin\AppData\Roaming\Download\035336.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4628
    - - C:\Users\Admin\AppData\Roaming\Download\035336.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\035336.exe"
        5⤵
        Executes dropped EXE
        
        PID:4388
  - - C:\Users\Admin\AppData\Roaming\Download\815960.exe
      "C:\Users\Admin\AppData\Roaming\Download\815960.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4716
    - - C:\Users\Admin\AppData\Roaming\Download\815960.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\815960.exe"
        5⤵
        Executes dropped EXE
        
        PID:912
  - - C:\Users\Admin\AppData\Roaming\Download\037236.exe
      "C:\Users\Admin\AppData\Roaming\Download\037236.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4584
    - - C:\Users\Admin\AppData\Roaming\Download\037236.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\037236.exe"
        5⤵
        Executes dropped EXE
        
        PID:676
  - - C:\Users\Admin\AppData\Roaming\Download\070394.exe
      "C:\Users\Admin\AppData\Roaming\Download\070394.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:1256
    - - C:\Users\Admin\AppData\Roaming\Download\070394.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\070394.exe"
        5⤵
        Executes dropped EXE
        
        PID:5092
  - - C:\Users\Admin\AppData\Roaming\Download\857928.exe
      "C:\Users\Admin\AppData\Roaming\Download\857928.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:2228
    - - C:\Users\Admin\AppData\Roaming\Download\857928.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\857928.exe"
        5⤵
        Executes dropped EXE
        
        PID:2244
  - - C:\Users\Admin\AppData\Roaming\Download\111029.exe
      "C:\Users\Admin\AppData\Roaming\Download\111029.exe" /Shorttailedrestart
      4⤵
      Executes dropped EXE
      PID:4228
    - - C:\Users\Admin\AppData\Roaming\Download\111029.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\111029.exe"
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Roaming\Download\879818.exe
      "C:\Users\Admin\AppData\Roaming\Download\879818.exe" /Shorttailedrestart
      4⤵
      PID:4232
    - - C:\Users\Admin\AppData\Roaming\Download\879818.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\879818.exe"
        5⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Roaming\Download\033719.exe
      "C:\Users\Admin\AppData\Roaming\Download\033719.exe" /Shorttailedrestart
      4⤵
      PID:4300
    - - C:\Users\Admin\AppData\Roaming\Download\033719.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\033719.exe"
        5⤵
        
        PID:3704
  - - C:\Users\Admin\AppData\Roaming\Download\086077.exe
      "C:\Users\Admin\AppData\Roaming\Download\086077.exe" /Shorttailedrestart
      4⤵
      PID:4552
    - - C:\Users\Admin\AppData\Roaming\Download\086077.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\086077.exe"
        5⤵
        
        PID:2052
  - - C:\Users\Admin\AppData\Roaming\Download\912896.exe
      "C:\Users\Admin\AppData\Roaming\Download\912896.exe" /Shorttailedrestart
      4⤵
      PID:4616
    - - C:\Users\Admin\AppData\Roaming\Download\912896.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\912896.exe"
        5⤵
        
        PID:504
  - - C:\Users\Admin\AppData\Roaming\Download\086777.exe
      "C:\Users\Admin\AppData\Roaming\Download\086777.exe" /Shorttailedrestart
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Roaming\Download\086777.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\086777.exe"
        5⤵
        
        PID:3740
  - - C:\Users\Admin\AppData\Roaming\Download\856301.exe
      "C:\Users\Admin\AppData\Roaming\Download\856301.exe" /Shorttailedrestart
      4⤵
      PID:2224
    - - C:\Users\Admin\AppData\Roaming\Download\856301.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\856301.exe"
        5⤵
        
        PID:4312
  - - C:\Users\Admin\AppData\Roaming\Download\853936.exe
      "C:\Users\Admin\AppData\Roaming\Download\853936.exe" /Shorttailedrestart
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Roaming\Download\853936.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\853936.exe"
        5⤵
        
        PID:4952
  - - C:\Users\Admin\AppData\Roaming\Download\876092.exe
      "C:\Users\Admin\AppData\Roaming\Download\876092.exe" /Shorttailedrestart
      4⤵
      PID:4996
    - - C:\Users\Admin\AppData\Roaming\Download\876092.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\876092.exe"
        5⤵
        
        PID:4668
  - - C:\Users\Admin\AppData\Roaming\Download\820370.exe
      "C:\Users\Admin\AppData\Roaming\Download\820370.exe" /Shorttailedrestart
      4⤵
      PID:976
    - - C:\Users\Admin\AppData\Roaming\Download\820370.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\820370.exe"
        5⤵
        
        PID:4792
  - - C:\Users\Admin\AppData\Roaming\Download\143435.exe
      "C:\Users\Admin\AppData\Roaming\Download\143435.exe" /Shorttailedrestart
      4⤵
      PID:4928
    - - C:\Users\Admin\AppData\Roaming\Download\143435.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\143435.exe"
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Roaming\Download\920060.exe
      "C:\Users\Admin\AppData\Roaming\Download\920060.exe" /Shorttailedrestart
      4⤵
      PID:200
    - - C:\Users\Admin\AppData\Roaming\Download\920060.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\920060.exe"
        5⤵
        
        PID:4496
  - - C:\Users\Admin\AppData\Roaming\Download\710604.exe
      "C:\Users\Admin\AppData\Roaming\Download\710604.exe" /Shorttailedrestart
      4⤵
      PID:4544
    - - C:\Users\Admin\AppData\Roaming\Download\710604.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\710604.exe"
        5⤵
        
        PID:3812
  - - C:\Users\Admin\AppData\Roaming\Download\943960.exe
      "C:\Users\Admin\AppData\Roaming\Download\943960.exe" /Shorttailedrestart
      4⤵
      PID:2540
    - - C:\Users\Admin\AppData\Roaming\Download\943960.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\943960.exe"
        5⤵
        
        PID:2768
  - - C:\Users\Admin\AppData\Roaming\Download\965026.exe
      "C:\Users\Admin\AppData\Roaming\Download\965026.exe" /Shorttailedrestart
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Roaming\Download\965026.exe
        
        "C:\Users\Admin\AppData\Roaming\Download\965026.exe"
        5⤵
        
        PID:3288
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat
  2⤵
  PID:4168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:200

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1120

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "
  2⤵
  PID:4384

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-3-0x0000000003C50000-0x0000000003C51000-memory.dmp

Download

memory/744-2-0x0000000003450000-0x0000000003451000-memory.dmp

Download

memory/744-8-0x0000000003450000-0x0000000003451000-memory.dmp

Download

memory/744-7-0x0000000003C50000-0x0000000003C51000-memory.dmp

Download

memory/744-6-0x0000000003450000-0x0000000003451000-memory.dmp

Download

memory/744-5-0x0000000003C50000-0x0000000003C51000-memory.dmp

Download

memory/744-4-0x0000000003450000-0x0000000003451000-memory.dmp

Download

memory/2528-106-0x0000000008440000-0x0000000008441000-memory.dmp

Download

memory/2632-864-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1166-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-584-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-583-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-582-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-612-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-581-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-580-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-579-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-578-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-577-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-576-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-575-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-614-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-613-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-574-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-573-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-572-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-571-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-615-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-618-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-617-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-616-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-570-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-569-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-568-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-567-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-566-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-565-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-564-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-563-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-562-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-561-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-560-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-559-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-558-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-557-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-556-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-555-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-554-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-553-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-552-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-551-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-550-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-549-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-548-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-592-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-606-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-608-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-611-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-610-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-627-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-626-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-16-0x0000000002E10000-0x0000000002E11000-memory.dmp

Download

memory/2632-609-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-607-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-605-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-15-0x0000000002610000-0x0000000002611000-memory.dmp

Download

memory/2632-714-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-713-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-715-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-716-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-717-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-719-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-720-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-721-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-724-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-723-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-722-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-725-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-718-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-727-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-728-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-726-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-712-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-711-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-710-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-729-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-732-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-733-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-734-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-730-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-731-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-735-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-739-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-738-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-737-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-736-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-741-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-743-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-744-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-747-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-748-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-750-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-749-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-751-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-746-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-745-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-742-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-753-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-752-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-740-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-754-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-755-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-756-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-759-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-760-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-761-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-763-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-765-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-769-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-770-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-771-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-772-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-775-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-776-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-774-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-777-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-780-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-779-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-782-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-781-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-783-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-778-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-784-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-785-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-773-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-768-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-767-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-766-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-764-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-762-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-758-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-757-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1563-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-604-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-603-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-586-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-23-0x0000000003B40000-0x0000000003B41000-memory.dmp

Download

memory/2632-794-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-795-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-796-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-798-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-797-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-799-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-801-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-800-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-802-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-803-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-809-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-810-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-807-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-811-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-806-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-812-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-805-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-808-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-813-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-815-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-816-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-814-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-804-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-817-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-821-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-827-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-826-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-828-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-829-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-830-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-825-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-831-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-824-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-823-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-832-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-822-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-833-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-820-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-819-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-818-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-835-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-836-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-834-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-837-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-838-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-839-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-841-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-842-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-843-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-844-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-845-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-850-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-849-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-848-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-851-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-868-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-847-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-846-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-867-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-866-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-865-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-602-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-863-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-862-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-861-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-860-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-859-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-858-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-857-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-856-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-855-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-854-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-853-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-852-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-840-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-22-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/2632-587-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-588-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1556-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-601-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-876-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-877-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-600-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-111-0x0000000003B40000-0x0000000003B41000-memory.dmp

Download

memory/2632-598-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1549-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-599-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-960-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-198-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-589-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-597-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-595-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-199-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1043-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1542-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-596-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-590-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-288-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-594-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1126-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1133-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1132-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1134-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1136-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1135-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1137-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1131-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1130-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1129-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1138-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1128-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1127-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1139-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1140-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1141-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1144-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1143-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1142-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1145-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1146-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1148-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1149-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1151-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1152-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1153-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1155-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1156-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1157-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1158-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1154-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1150-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1159-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1161-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1160-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1162-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1163-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1164-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1165-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1168-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1147-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1167-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1169-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1170-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1171-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1174-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1175-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1176-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1173-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1172-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-585-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1177-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1178-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1180-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1179-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1181-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1193-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1192-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1194-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1195-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1191-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1190-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1196-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1198-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1200-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1199-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1197-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1189-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1188-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1187-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1186-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1185-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1184-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1183-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1182-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1535-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-593-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-591-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-289-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-547-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1208-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-1209-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1211-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1210-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1212-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1216-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1217-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1266-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1267-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1268-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1269-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1264-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1263-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1262-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1261-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1260-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1259-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1258-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1270-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1257-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1256-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1255-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1254-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1253-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1252-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1251-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1271-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1250-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1249-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1248-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1247-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1246-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1245-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1244-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1243-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1242-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1241-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1240-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1239-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1238-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1237-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1236-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1235-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1234-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1233-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1232-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1272-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1231-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1230-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1229-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1273-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1228-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1227-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1226-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1274-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1225-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1224-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1223-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1222-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1221-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1220-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1219-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1218-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1265-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1215-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1275-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1214-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1213-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1276-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1277-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1279-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1283-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1282-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1281-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1280-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-1278-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-290-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-546-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-545-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-544-0x0000000002950000-0x0000000002951000-memory.dmp

Download

memory/2632-543-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1292-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-542-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-292-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-291-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-459-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1528-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1374-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-293-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-295-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-374-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-296-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-375-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1381-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-294-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-297-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-298-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-299-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-366-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1388-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1387-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-365-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-364-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-363-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1514-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-358-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1394-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-1395-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-301-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-360-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-362-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-361-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-303-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1401-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-1402-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-359-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-357-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-356-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-302-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-355-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1409-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-354-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-353-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-304-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1507-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-352-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1416-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-305-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-351-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-350-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-300-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-349-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1423-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-306-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-348-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-347-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-345-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-346-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1430-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-307-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-344-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-343-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-342-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1500-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1437-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-1436-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2632-308-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-341-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-340-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-339-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-338-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1444-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-337-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-336-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-309-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-335-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-333-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1451-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-334-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-332-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-330-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-310-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-331-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1458-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-329-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-328-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-314-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-315-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-327-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1465-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-311-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-316-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-326-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1493-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-325-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1472-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-312-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-324-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-323-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-313-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-322-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1479-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download

memory/2632-321-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-318-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-320-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-317-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-319-0x0000000002950000-0x0000000002960000-memory.dmp

Download

memory/2632-1486-0x0000000003B50000-0x0000000003B51000-memory.dmp

Download