raccoon | a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803

Analysis

max time kernel
151s
max time network
153s
platform
windows10-1703_x64
resource
win10-20220722-en
resource tags

arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system
submitted
07-08-2022 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
Size

1.2MB
MD5

3f0373c5bcfed4d6abbf029eebce8ed5
SHA1

0a99c5eb158f34e97c7f64806f1ae82240b23765
SHA256

a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803
SHA512

ea7c2ed9580ac96e3b9b8a94ee38799ad5d359473b5242566b12965ab278037f7dd999e1693d604c33638c52702861452f5a7bfd8ef4251b1e5ec867997268e4

Score

10^/10

raccoon redline xmrig 4 5076357887 @tag12312341 f0c8034c83808635df0d9d8726d1bfd6 nam3 discovery infostealer miner persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

nam3

103.89.90.61:18728

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

raccoon

Botnet

f0c8034c83808635df0d9d8726d1bfd6

http://45.95.11.158/

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5116-711-0x0000000000030000-0x000000000003F000-memory.dmp	family_raccoon
behavioral1/memory/5116-717-0x0000000000400000-0x000000000062B000-memory.dmp	family_raccoon
behavioral1/memory/5116-855-0x0000000000400000-0x000000000062B000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 12 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
behavioral1/memory/3504-555-0x0000000000050000-0x0000000000070000-memory.dmp	family_redline
behavioral1/memory/4916-557-0x0000000000BE0000-0x0000000000C24000-memory.dmp	family_redline
behavioral1/memory/3972-556-0x0000000000320000-0x0000000000364000-memory.dmp	family_redline
behavioral1/memory/1868-560-0x0000000000FA0000-0x0000000000FC0000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
C:\ProgramData\Dllhost\winlogson.exe	xmrig

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

namdoitntn.exereal.exesafert44.exekukurzka9000.exeF0geI.exetag.exejshainx.exeEU1.exewuwu.exeMinecraftForge.exepopa.exedllhost.exeMoUSO.exewinlogson.exe

pid	process
4916	namdoitntn.exe
1468	real.exe
3972	safert44.exe
4964	kukurzka9000.exe
5116	F0geI.exe
1868	tag.exe
3504	jshainx.exe
3576	EU1.exe
5732	wuwu.exe
2136	MinecraftForge.exe
9284	popa.exe
379404	dllhost.exe
379676	MoUSO.exe
96856	winlogson.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Control Panel\International\Geo\Nation	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

Processes:

wuwu.exepopa.exe

description	pid	process	target process
PID 5732 set thread context of 335592	5732	wuwu.exe	AppLaunch.exe
PID 9284 set thread context of 379152	9284	popa.exe	AppLaunch.exe

Drops file in Program Files directory 8 IoCs

Processes:

a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\EU1.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe

Drops file in Windows directory 9 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3580 1468 WerFault.exe real.exe
350468 5732 WerFault.exe wuwu.exe
379320 9284 WerFault.exe popa.exe

pid	pid_target	process	target process
3580	1468	WerFault.exe	real.exe
350468	5732	WerFault.exe	wuwu.exe
379320	9284	WerFault.exe	popa.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
379756	schtasks.exe
379304	schtasks.exe
379180	schtasks.exe
5420	schtasks.exe
379348	schtasks.exe
379232	schtasks.exe
379164	schtasks.exe
379156	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4046547c32aad801	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 93b6c19f32aad801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 20e4bd74bdbdd801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1b9221d4c39dd801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "366660746"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4cf1867e32aad801	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\AA549154B737EF29C	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000465e811df01b7f1fe84ee8b8f3713577eed4a3220448879bb51ac1f4a31e17bdce9efa485b7acf93a8d342d0af4bb6efc0ddd920dfde403f8fb828e9	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{9B45064A-45D9-43CD-85E5-1F4932E89429} = "0"	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

real.exesafert44.exetag.exejshainx.exenamdoitntn.exeMinecraftForge.exepowershell.exedllhost.exe

pid	process
1468	real.exe
1468	real.exe
3972	safert44.exe
3972	safert44.exe
1868	tag.exe
1868	tag.exe
3504	jshainx.exe
3504	jshainx.exe
4916	namdoitntn.exe
4916	namdoitntn.exe
2136	MinecraftForge.exe
2136	MinecraftForge.exe
379712	powershell.exe
379712	powershell.exe
379712	powershell.exe
379712	powershell.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe
379404	dllhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

628

pid	process
628

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
1192	MicrosoftEdgeCP.exe
1192	MicrosoftEdgeCP.exe
1192	MicrosoftEdgeCP.exe
1192	MicrosoftEdgeCP.exe
1192	MicrosoftEdgeCP.exe
1192	MicrosoftEdgeCP.exe
1192	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesafert44.exetag.exejshainx.exenamdoitntn.exeMinecraftForge.exepowershell.exedllhost.exewinlogson.exe

description	pid	process
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	3404	MicrosoftEdge.exe
Token: SeDebugPrivilege	4872	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4872	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4872	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4872	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5832	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5832	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3972	safert44.exe
Token: SeDebugPrivilege	1868	tag.exe
Token: SeDebugPrivilege	3504	jshainx.exe
Token: SeDebugPrivilege	4916	namdoitntn.exe
Token: SeDebugPrivilege	2136	MinecraftForge.exe
Token: SeDebugPrivilege	379712	powershell.exe
Token: SeDebugPrivilege	379404	dllhost.exe
Token: SeLockMemoryPrivilege	96856	winlogson.exe
Token: SeLockMemoryPrivilege	96856	winlogson.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winlogson.exe

pid process

96856 winlogson.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3404 MicrosoftEdge.exe
1192 MicrosoftEdgeCP.exe
1192 MicrosoftEdgeCP.exe

pid	process
96856	winlogson.exe

pid	process
3404	MicrosoftEdge.exe
1192	MicrosoftEdgeCP.exe
1192	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exetag.exejshainx.exewuwu.exepopa.exe

description	pid	process	target process
PID 4728 wrote to memory of 4916	4728	MicrosoftEdgeCP.exe	namdoitntn.exe
PID 4728 wrote to memory of 4916	4728	MicrosoftEdgeCP.exe	namdoitntn.exe
PID 4728 wrote to memory of 4916	4728	MicrosoftEdgeCP.exe	namdoitntn.exe
PID 4728 wrote to memory of 1468	4728	MicrosoftEdgeCP.exe	real.exe
PID 4728 wrote to memory of 1468	4728	MicrosoftEdgeCP.exe	real.exe
PID 4728 wrote to memory of 1468	4728	MicrosoftEdgeCP.exe	real.exe
PID 4728 wrote to memory of 3972	4728	MicrosoftEdgeCP.exe	safert44.exe
PID 4728 wrote to memory of 3972	4728	MicrosoftEdgeCP.exe	safert44.exe
PID 4728 wrote to memory of 3972	4728	MicrosoftEdgeCP.exe	safert44.exe
PID 4728 wrote to memory of 4964	4728	MicrosoftEdgeCP.exe	kukurzka9000.exe
PID 4728 wrote to memory of 4964	4728	MicrosoftEdgeCP.exe	kukurzka9000.exe
PID 4728 wrote to memory of 4964	4728	MicrosoftEdgeCP.exe	kukurzka9000.exe
PID 4728 wrote to memory of 5116	4728	MicrosoftEdgeCP.exe	F0geI.exe
PID 4728 wrote to memory of 5116	4728	MicrosoftEdgeCP.exe	F0geI.exe
PID 4728 wrote to memory of 5116	4728	MicrosoftEdgeCP.exe	F0geI.exe
PID 4728 wrote to memory of 1868	4728	MicrosoftEdgeCP.exe	tag.exe
PID 4728 wrote to memory of 1868	4728	MicrosoftEdgeCP.exe	tag.exe
PID 4728 wrote to memory of 1868	4728	MicrosoftEdgeCP.exe	tag.exe
PID 4728 wrote to memory of 3504	4728	MicrosoftEdgeCP.exe	jshainx.exe
PID 4728 wrote to memory of 3504	4728	MicrosoftEdgeCP.exe	jshainx.exe
PID 4728 wrote to memory of 3504	4728	MicrosoftEdgeCP.exe	jshainx.exe
PID 4728 wrote to memory of 3576	4728	MicrosoftEdgeCP.exe	EU1.exe
PID 4728 wrote to memory of 3576	4728	MicrosoftEdgeCP.exe	EU1.exe
PID 4728 wrote to memory of 3576	4728	MicrosoftEdgeCP.exe	EU1.exe
PID 1192 wrote to memory of 4872	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4872	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4872	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4872	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4124	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 2192	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4124	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 2192	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 2192	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 2192	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4124	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4124	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 3952	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 3952	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 3952	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 3952	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4748	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4748	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4748	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4748	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4728	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4728	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4728	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1192 wrote to memory of 4728	1192	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 1868 wrote to memory of 5732	1868	tag.exe	wuwu.exe
PID 1868 wrote to memory of 5732	1868	tag.exe	wuwu.exe
PID 1868 wrote to memory of 5732	1868	tag.exe	wuwu.exe
PID 3504 wrote to memory of 2136	3504	jshainx.exe	MinecraftForge.exe
PID 3504 wrote to memory of 2136	3504	jshainx.exe	MinecraftForge.exe
PID 3504 wrote to memory of 2136	3504	jshainx.exe	MinecraftForge.exe
PID 1868 wrote to memory of 9284	1868	tag.exe	popa.exe
PID 1868 wrote to memory of 9284	1868	tag.exe	popa.exe
PID 1868 wrote to memory of 9284	1868	tag.exe	popa.exe
PID 5732 wrote to memory of 335592	5732	wuwu.exe	AppLaunch.exe
PID 5732 wrote to memory of 335592	5732	wuwu.exe	AppLaunch.exe
PID 5732 wrote to memory of 335592	5732	wuwu.exe	AppLaunch.exe
PID 5732 wrote to memory of 335592	5732	wuwu.exe	AppLaunch.exe
PID 5732 wrote to memory of 335592	5732	wuwu.exe	AppLaunch.exe
PID 9284 wrote to memory of 379152	9284	popa.exe	AppLaunch.exe
PID 9284 wrote to memory of 379152	9284	popa.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe
"C:\Users\Admin\AppData\Local\Temp\a22742c7a6e494902e20dc3f800c4277f7d4089a2fcad9c014214bec7cebe803.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:4728

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1288
3⤵
- Program crash
PID:3580

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:4964

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:5116

C:\Program Files (x86)\Company\NewProduct\tag.exe
"C:\Program Files (x86)\Company\NewProduct\tag.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\wuwu.exe
"C:\Users\Admin\AppData\Local\Temp\wuwu.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:335592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 187108
4⤵
- Program crash
PID:350468

C:\Users\Admin\AppData\Local\Temp\popa.exe
"C:\Users\Admin\AppData\Local\Temp\popa.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:9284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:379152

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
5⤵
- Creates scheduled task(s)
PID:379180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9284 -s 374040
4⤵
- Program crash
PID:379320

C:\Program Files (x86)\Company\NewProduct\jshainx.exe
"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504

C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
4⤵
PID:379452

C:\Windows\SysWOW64\chcp.com
chcp 1251
5⤵
PID:379528

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:379712

C:\ProgramData\Dllhost\dllhost.exe
"C:\ProgramData\Dllhost\dllhost.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:379404

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:96856

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:5420

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:1844

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:379232

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5700

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379356

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:379164

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379216

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:379348

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379444

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5101" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379748

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9100" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379844

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9100" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:379756

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8678" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379648

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8678" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:379304

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379180

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379484

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:379156

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk232" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:379416

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
5⤵
PID:5960

C:\Windows\SysWOW64\chcp.com
chcp 1251
6⤵
PID:4420

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
5⤵
PID:1588

C:\Windows\SysWOW64\chcp.com
chcp 1251
6⤵
PID:379348

C:\ProgramData\Dllhost\winlogson.exe
C:\ProgramData\Dllhost\winlogson.exe -c config.json
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:96856

C:\Program Files (x86)\Company\NewProduct\EU1.exe
"C:\Program Files (x86)\Company\NewProduct\EU1.exe"
2⤵
- Executes dropped EXE
PID:3576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3404

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3176

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4124

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4748

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2552

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:379688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:379240

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Executes dropped EXE
PID:379676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\EU1.exe
Filesize
289KB

MD5
98ee616bbbdae32bd744f31d48e46c72

SHA1
fb2fe19e8890c7c4be116db78254fe3e1beb08a0

SHA256
5e0e8817946e234867eb10b92ce613a12d1597ca53e73020ec19e1c76b3566cb

SHA512
fab7fc5c37551ca64daad4611b62d456ed245946298f1b813120ca0fe45ffb76c29ec8402327e58c565fdf42f2b1d0bd18864b4ab63f85742e2b99772981af9d

Download Submit
C:\Program Files (x86)\Company\NewProduct\EU1.exe
Filesize
289KB

MD5
98ee616bbbdae32bd744f31d48e46c72

SHA1
fb2fe19e8890c7c4be116db78254fe3e1beb08a0

SHA256
5e0e8817946e234867eb10b92ce613a12d1597ca53e73020ec19e1c76b3566cb

SHA512
fab7fc5c37551ca64daad4611b62d456ed245946298f1b813120ca0fe45ffb76c29ec8402327e58c565fdf42f2b1d0bd18864b4ab63f85742e2b99772981af9d

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
178KB

MD5
8d24da259cd54db3ede2745724dbedab

SHA1
96f51cc49e1a6989dea96f382f2a958f488662a9

SHA256
42f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883

SHA512
ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
178KB

MD5
8d24da259cd54db3ede2745724dbedab

SHA1
96f51cc49e1a6989dea96f382f2a958f488662a9

SHA256
42f46c886e929d455bc3adbd693150d16f94aa48b050cfa463e399521c50e883

SHA512
ec005a5ae8585088733fb692d78bbf2ff0f4f395c4b734e9d3bed66d6a73c2ee24c02da20351397768f2420c703ad47ffee785a2a2af455a000ab0e6620ec536

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
82259f982c66e0bdb6a9976e6eff4665

SHA1
df559539e52d4277762535fc694e888487e58e01

SHA256
ba7eda28581bd1147ab6661aacd1b61435671381c9bae3a8a6651aa40a8a0bce

SHA512
e9e42def570e1d27574f80979fabb742861eaa828a96240d2a84b3418318460b96ed6b9209699c08221abb5765c7b1a708de6f89903d812c621259e0802b7ec1

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.5MB

MD5
82259f982c66e0bdb6a9976e6eff4665

SHA1
df559539e52d4277762535fc694e888487e58e01

SHA256
ba7eda28581bd1147ab6661aacd1b61435671381c9bae3a8a6651aa40a8a0bce

SHA512
e9e42def570e1d27574f80979fabb742861eaa828a96240d2a84b3418318460b96ed6b9209699c08221abb5765c7b1a708de6f89903d812c621259e0802b7ec1

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
245KB

MD5
b16134159e66a72fb36d93bc703b4188

SHA1
e869e91a2b0f77e7ac817e0b30a9a23d537b3001

SHA256
b064af166491cb307cfcb9ce53c09696d9d3f6bfa65dfc60b237c275be9b655c

SHA512
3fdf205ca16de89c7ed382ed42f628e1211f3e5aff5bf7dedc47927f3dd7ff54b0dd10b4e8282b9693f45a5ee7a26234f899d14bfd8eb0fd078b42a4ed8b8b4c

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
84d016c5a9e810c2ef08767805a87589

SHA1
750b15c9c1acdfcd1396ecec11ab109706a945ad

SHA256
6e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845

SHA512
7c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
289KB

MD5
84d016c5a9e810c2ef08767805a87589

SHA1
750b15c9c1acdfcd1396ecec11ab109706a945ad

SHA256
6e8bae93bead10d8778a8f442828aac20a0bd5c87cabe3f6d76282a9d47b7845

SHA512
7c612dd0f3eab6cb602c12390f62daa0e75d83433bcd4b682d1d5b931ebc52c8f6b32acd12474bdf6eecb91541dfa11cbbd57ca6cf8297ae9c407923e4d95953

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
244KB

MD5
dbe947674ea388b565ae135a09cc6638

SHA1
ae8e1c69bd1035a92b7e06baad5e387de3a70572

SHA256
86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709

SHA512
67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\ProgramData\Dllhost\dllhost.exe
Filesize
953KB

MD5
7dadec75c72d9ca68ad351b147ce82d7

SHA1
258718e852b80a293ea8505b2946190dcb3cd806

SHA256
12deb4d3b58a9102ba0a9493ce1e2ea38a57a50214e1da4261b1e2b3d7f5539a

SHA512
655e72a33457425b08592b7db8ab62ed232114355079de20fca23535e69e59bef13e971f48af83a382070abbb7620499b32bd8da5ad6b79f0e5f8502266ccf0d

Download Submit
C:\ProgramData\Dllhost\dllhost.exe
Filesize
953KB

MD5
7dadec75c72d9ca68ad351b147ce82d7

SHA1
258718e852b80a293ea8505b2946190dcb3cd806

SHA256
12deb4d3b58a9102ba0a9493ce1e2ea38a57a50214e1da4261b1e2b3d7f5539a

SHA512
655e72a33457425b08592b7db8ab62ed232114355079de20fca23535e69e59bef13e971f48af83a382070abbb7620499b32bd8da5ad6b79f0e5f8502266ccf0d

Download Submit
C:\ProgramData\Dllhost\winlogson.exe
Filesize
7.9MB

MD5
ae6c92c8073b1239390369d3ed93538f

SHA1
a76ea83bdcfa472cd593363e9bb254df494a5577

SHA256
d8d0e8ce7d532250713c7ac9c3e3d144463ce9f47bbf5bd6fc3bb939c739c1a0

SHA512
59de08ea3849243addb3b6aaa2b3ebf71a271eee77239bea0dd190d446a6eec56fd7c5b4fa3668c14074f33f06ab1f011baa0ac2266f6d2d33eb59847841c350

Download Submit
C:\ProgramData\SystemFiles\config.json
Filesize
309B

MD5
391e2721b94b00e97e4b1406cd69df8e

SHA1
833a33e6b995500a674529a42f513856e557b4d5

SHA256
a866ae7f0f1b8648a97e1f1e4cd993309717f4525ccc6046daf88644f717f787

SHA512
4c08ebe8ac673e885d7be58a96f2ef74eabec8dbcbc4cdf011dbfe27d04fcb8009a0e8da8ad005e7da805e8668fe40c63a538f0c6e564f7548ef69d0e3777d48

Download Submit
C:\ProgramData\SystemFiles\sys_rh.bin
Filesize
1KB

MD5
0cdf43198d2721395850bbe27d83391f

SHA1
4d80abbc82b8ab42e0e798e61e2778445d2c2a1c

SHA256
9b8144e93a03858de025bd01b0bb5d6c757da4ec91343a5a2a8e3832606cea01

SHA512
7f7f393034d73c275adf92d61271e51c7156e8d5df19f76653ed1abebf44b2b40e48369daf5f9729bbd585b5f3c70f1abfdec31c777be134ef8c6cbf4c812907

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\02SVMHVQ.cookie
Filesize
172B

MD5
d731a1b5847bb15e57cbd83d6df9b1b0

SHA1
a5b8bd11bf9b55daa7a7fac7afeb38dc8466a678

SHA256
8ecb3a25440d4b479ef8e6c79b4c4818ff1cca14ee46d8d7a9d9a95108018342

SHA512
1e6246c40af5293f1595f1ad468e3c53deb6a4b12052273f70c7ebdeec5ffd2199be82694332df41b2e9c05ddb8b2637519a32798a55c5c44fcd276305858502

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\LVUYZ7PW.cookie
Filesize
418B

MD5
ba3a901f8d022b551c7321ef189930b7

SHA1
f4622cbdc1f04f22354cda0d78e0a4f9fafa53fe

SHA256
97464bfb5d77e143fd5afdc4435eb5362528450f0e62883157a6b7853a56359f

SHA512
4ae12c2f711fc47fe8042599ccd002eaf692aadb078a27f0ed77cae145e896198b6e5abeb2728c211bc7449c1e64474cb1f7e686e0ab6244e3b4c4cd8c413d6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\LX16HCTT.cookie
Filesize
256B

MD5
e626eb431ab26345fa868db28c7eb179

SHA1
065bd86e837f5286a9fdd9358e4fe9acdec9f75e

SHA256
8037c9b716138ae4bc98a3ef49290e59ea436a18ae079b57cdbcd541b7939ec1

SHA512
1ef174c06b9c284d13bd032facae23e1f30cbac9494dd0b99f95eaa638031df29d8811f4bf20f025c821311425dd7c8c90db844ab338ba6408a6ea9c9de912a4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\PZLREIAS.cookie
Filesize
336B

MD5
dc3960a9557cdfb610f444964c3989ed

SHA1
6f1fb6cdeba0fdbbe6ca2c8cd7893bf12157de95

SHA256
724f233b2db982628aa15ec8dc4b3e89ccf3e5af8739079a0890331638c95e2b

SHA512
a8b550fb5d812a0163d353a30fc44a54f559856b666d3d698539961d5de9cf0b380df11be9453b9b5167abbcdf6202cac1f397aaed20d19811d91381e88da285

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\Q5MII9F6.cookie
Filesize
500B

MD5
9fa7230d9b33301ddef60bda2e06dd21

SHA1
8f2059d9631135a183395dffd1a706a3922c745c

SHA256
8f73d61498076fcb0ef820aad7ec29fa3a96b0c262c2d62cb57951b22e95abfb

SHA512
feb2744c2344758f661b05528bba51db6927eef3a51bdbfc83263713c2b8149f7559fd3985ea5e75435fd0e2f12063d625fc9b9e658b25c6e36a703fb3a190c6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\TRA3MMCB.cookie
Filesize
582B

MD5
1b1ae8177c05558957e88b5f1e4ba646

SHA1
992b8574de94ad52d9523b76e292c819a6ab264b

SHA256
9a5c3abfc55f119588607a39f78633e021ce29bec76fa31da81f3b0096dd8535

SHA512
225201d7568a92d04a4cbe218c901a23b06a3523ca9570100eac82e14c9a65c614c03b296b509efef37dcc94e2de1232a5b9a414c6fb5f9f41fc07f29376f036

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
f91f63369d565274f849d2da69b5e009

SHA1
fcf897dd4b9d25fb8f22ab7e9a896137f46e274a

SHA256
d2f6df051b8f40f3b514c8cd418b8fe2f8ce380322f0d0d781cd9540a4dabaaf

SHA512
904c030410e191fb0692cc7b19c6c96c98901631eb276573f9929fc3b73e25ea160b1e43f3e06783282969e5d25db042beaee9fadd7182ffed52568dc2a81cff

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
Filesize
71KB

MD5
f8370d132f334be6703ce54b08db1578

SHA1
55d98f702724f25535bfbeb7a46cee92d57a4421

SHA256
2b058754c1b4402ccc99db8e247f234593bb96015af801f2ee6880425b126fb6

SHA512
0eee39de1ffb965744c97a1c6918ccd755a4fae18d889893244e9d0e3760f28615e46cce524930f1d9f18540bbd6644cd45765c8f95f04c615a0ff682136b35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
Filesize
71KB

MD5
f8370d132f334be6703ce54b08db1578

SHA1
55d98f702724f25535bfbeb7a46cee92d57a4421

SHA256
2b058754c1b4402ccc99db8e247f234593bb96015af801f2ee6880425b126fb6

SHA512
0eee39de1ffb965744c97a1c6918ccd755a4fae18d889893244e9d0e3760f28615e46cce524930f1d9f18540bbd6644cd45765c8f95f04c615a0ff682136b35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\popa.exe
Filesize
1.4MB

MD5
44215b01b61484c117abcfdaebeb9529

SHA1
8ae6ccf9140796d8c0ea8919f3338fe624be7f8d

SHA256
1db3612624e4c1aa7e7526ad4f975f789f45f5647d7270bd886bccbbc97caf44

SHA512
6e3e55aa88466e138319418897843e28ecbc048338a6d1998a739cdb129ac7cbc2bf8304d488090047258146c2b00e4c9f07a4aa0cd50b5fd1703203f3418561

Download Submit
C:\Users\Admin\AppData\Local\Temp\popa.exe
Filesize
1.4MB

MD5
44215b01b61484c117abcfdaebeb9529

SHA1
8ae6ccf9140796d8c0ea8919f3338fe624be7f8d

SHA256
1db3612624e4c1aa7e7526ad4f975f789f45f5647d7270bd886bccbbc97caf44

SHA512
6e3e55aa88466e138319418897843e28ecbc048338a6d1998a739cdb129ac7cbc2bf8304d488090047258146c2b00e4c9f07a4aa0cd50b5fd1703203f3418561

Download Submit
C:\Users\Admin\AppData\Local\Temp\wuwu.exe
Filesize
1.2MB

MD5
f8fa75d16db46551b6ba6ccc051b2c60

SHA1
8ac07b0daffb419b2de3c6ac937ec3af43e11e18

SHA256
e259aedf6f361fccef9cc27e1bbef1a44f26e433a96022953f92dacaaf103f03

SHA512
4d9a07c5f06b51d1880c503f42040e463f42fc1ddc1f4bce4ffcca4b593e60f185a6dd301d12779767ae1889815fbe983500b379e5fe876693d536e59579d040

Download Submit
C:\Users\Admin\AppData\Local\Temp\wuwu.exe
Filesize
1.2MB

MD5
f8fa75d16db46551b6ba6ccc051b2c60

SHA1
8ac07b0daffb419b2de3c6ac937ec3af43e11e18

SHA256
e259aedf6f361fccef9cc27e1bbef1a44f26e433a96022953f92dacaaf103f03

SHA512
4d9a07c5f06b51d1880c503f42040e463f42fc1ddc1f4bce4ffcca4b593e60f185a6dd301d12779767ae1889815fbe983500b379e5fe876693d536e59579d040

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
memory/1468-297-0x0000000000000000-mapping.dmp

Download
memory/1588-1825-0x0000000000000000-mapping.dmp

Download
memory/1844-1376-0x0000000000000000-mapping.dmp

Download
memory/1868-664-0x00000000057B0000-0x00000000057C2000-memory.dmp

Filesize
72KB

Download
memory/1868-560-0x0000000000FA0000-0x0000000000FC0000-memory.dmp

Filesize
128KB

Download
memory/1868-667-0x00000000058E0000-0x00000000059EA000-memory.dmp

Filesize
1.0MB

Download
memory/1868-316-0x0000000000000000-mapping.dmp

Download
memory/1868-864-0x0000000006AE0000-0x0000000006B30000-memory.dmp

Filesize
320KB

Download
memory/2136-1010-0x00000000011B0000-0x00000000011B6000-memory.dmp

Filesize
24KB

Download
memory/2136-999-0x00000000007A0000-0x00000000007B8000-memory.dmp

Filesize
96KB

Download
memory/2136-947-0x0000000000000000-mapping.dmp

Download
memory/2136-1028-0x00000000050D0000-0x00000000050DA000-memory.dmp

Filesize
40KB

Download
memory/3504-322-0x0000000000000000-mapping.dmp

Download
memory/3504-799-0x0000000004BF0000-0x0000000004C56000-memory.dmp

Filesize
408KB

Download
memory/3504-851-0x00000000063B0000-0x0000000006572000-memory.dmp

Filesize
1.8MB

Download
memory/3504-659-0x0000000004DD0000-0x00000000053D6000-memory.dmp

Filesize
6.0MB

Download
memory/3504-555-0x0000000000050000-0x0000000000070000-memory.dmp

Filesize
128KB

Download
memory/3576-323-0x0000000000000000-mapping.dmp

Download
memory/3972-602-0x0000000000D30000-0x0000000000D36000-memory.dmp

Filesize
24KB

Download
memory/3972-556-0x0000000000320000-0x0000000000364000-memory.dmp

Filesize
272KB

Download
memory/3972-679-0x000000000A390000-0x000000000A3DB000-memory.dmp

Filesize
300KB

Download
memory/3972-805-0x000000000B3F0000-0x000000000B8EE000-memory.dmp

Filesize
5.0MB

Download
memory/3972-675-0x000000000A330000-0x000000000A36E000-memory.dmp

Filesize
248KB

Download
memory/3972-301-0x0000000000000000-mapping.dmp

Download
memory/3972-797-0x000000000A660000-0x000000000A6D6000-memory.dmp

Filesize
472KB

Download
memory/3972-852-0x000000000D070000-0x000000000D59C000-memory.dmp

Filesize
5.2MB

Download
memory/3972-802-0x000000000A780000-0x000000000A812000-memory.dmp

Filesize
584KB

Download
memory/4420-1583-0x0000000000000000-mapping.dmp

Download
memory/4728-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-190-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-189-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-188-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-187-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-186-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-185-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

Filesize
1.6MB

Download
memory/4916-812-0x00000000060F0000-0x000000000610E000-memory.dmp

Filesize
120KB

Download
memory/4916-296-0x0000000000000000-mapping.dmp

Download
memory/4916-604-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/4916-557-0x0000000000BE0000-0x0000000000C24000-memory.dmp

Filesize
272KB

Download
memory/4964-304-0x0000000000000000-mapping.dmp

Download
memory/5116-717-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/5116-853-0x0000000000872000-0x0000000000883000-memory.dmp

Filesize
68KB

Download
memory/5116-1001-0x0000000000872000-0x0000000000883000-memory.dmp

Filesize
68KB

Download
memory/5116-311-0x0000000000000000-mapping.dmp

Download
memory/5116-855-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download
memory/5116-709-0x0000000000872000-0x0000000000883000-memory.dmp

Filesize
68KB

Download
memory/5116-711-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/5420-1477-0x0000000000000000-mapping.dmp

Download
memory/5700-1383-0x0000000000000000-mapping.dmp

Download
memory/5732-936-0x0000000000000000-mapping.dmp

Download
memory/5960-1577-0x0000000000000000-mapping.dmp

Download
memory/9284-963-0x0000000000000000-mapping.dmp

Download
memory/96856-1372-0x0000000000000000-mapping.dmp

Download
memory/96856-1844-0x00000278F5210000-0x00000278F5230000-memory.dmp

Filesize
128KB

Download
memory/96856-1840-0x0000000000000000-mapping.dmp

Download
memory/335592-1050-0x0000000000729223-mapping.dmp

Download
memory/379152-1071-0x0000000000612DAA-mapping.dmp

Download
memory/379156-1506-0x0000000000000000-mapping.dmp

Download
memory/379164-1499-0x0000000000000000-mapping.dmp

Download
memory/379180-1406-0x0000000000000000-mapping.dmp

Download
memory/379180-1180-0x0000000000000000-mapping.dmp

Download
memory/379216-1379-0x0000000000000000-mapping.dmp

Download
memory/379232-1491-0x0000000000000000-mapping.dmp

Download
memory/379304-1517-0x0000000000000000-mapping.dmp

Download
memory/379348-1831-0x0000000000000000-mapping.dmp

Download
memory/379348-1479-0x0000000000000000-mapping.dmp

Download
memory/379356-1388-0x0000000000000000-mapping.dmp

Download
memory/379404-1337-0x0000000004F10000-0x0000000004F16000-memory.dmp

Filesize
24KB

Download
memory/379404-1286-0x0000000000000000-mapping.dmp

Download
memory/379404-1330-0x0000000000460000-0x0000000000554000-memory.dmp

Filesize
976KB

Download
memory/379416-1432-0x0000000000000000-mapping.dmp

Download
memory/379444-1393-0x0000000000000000-mapping.dmp

Download
memory/379452-1118-0x0000000000000000-mapping.dmp

Download
memory/379484-1400-0x0000000000000000-mapping.dmp

Download
memory/379528-1127-0x0000000000000000-mapping.dmp

Download
memory/379648-1413-0x0000000000000000-mapping.dmp

Download
memory/379712-1214-0x0000000006CC0000-0x00000000072E8000-memory.dmp

Filesize
6.2MB

Download
memory/379712-1233-0x0000000006C30000-0x0000000006C52000-memory.dmp

Filesize
136KB

Download
memory/379712-1339-0x0000000009230000-0x00000000092C4000-memory.dmp

Filesize
592KB

Download
memory/379712-1280-0x0000000008F20000-0x0000000008F53000-memory.dmp

Filesize
204KB

Download
memory/379712-1263-0x0000000007580000-0x000000000759C000-memory.dmp

Filesize
112KB

Download
memory/379712-1260-0x00000000076E0000-0x0000000007A30000-memory.dmp

Filesize
3.3MB

Download
memory/379712-1249-0x0000000007420000-0x0000000007486000-memory.dmp

Filesize
408KB

Download
memory/379712-1746-0x0000000008C30000-0x0000000008C4A000-memory.dmp

Filesize
104KB

Download
memory/379712-1751-0x0000000008C20000-0x0000000008C28000-memory.dmp

Filesize
32KB

Download
memory/379712-1264-0x0000000007B30000-0x0000000007B7B000-memory.dmp

Filesize
300KB

Download
memory/379712-1281-0x0000000008EE0000-0x0000000008EFE000-memory.dmp

Filesize
120KB

Download
memory/379712-1202-0x0000000006650000-0x0000000006686000-memory.dmp

Filesize
216KB

Download
memory/379712-1147-0x0000000000000000-mapping.dmp

Download
memory/379712-1298-0x00000000090E0000-0x0000000009185000-memory.dmp

Filesize
660KB

Download
memory/379748-1418-0x0000000000000000-mapping.dmp

Download
memory/379756-1519-0x0000000000000000-mapping.dmp

Download
memory/379844-1424-0x0000000000000000-mapping.dmp

Download