redline | cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54

Analysis

max time kernel
150s
max time network
144s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
13-08-2022 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
Size

1.7MB
MD5

bb8280909fc1e2c496c93c57f5c814ec
SHA1

7d70a7fb02119891e88f8ec50a2878ae0856b83b
SHA256

cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54
SHA512

1c72c19d5bdd14b4d28049036ff6215fe3c448c92770d6f5ef8c1d1d913287d2d8340e6a514f604620b890ecec82ec126f14712151b8deb5c23999358dd3508a

Score

10^/10

redline 5 5076357887 @tag12312341 nam3 ruxarr_gg discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

@tag12312341

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

RuXaRR_GG

insttaller.com:40915

Attributes

auth_value
4a733ff307847db3ee220c11d113a305

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 15 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\tag.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\safert44.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\jshainx.exe	family_redline
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	family_redline
behavioral1/memory/4800-576-0x0000000000260000-0x0000000000280000-memory.dmp	family_redline
behavioral1/memory/4852-581-0x0000000000160000-0x00000000001A4000-memory.dmp	family_redline
behavioral1/memory/5092-585-0x0000000000E70000-0x0000000000E90000-memory.dmp	family_redline
behavioral1/memory/4200-646-0x0000000000440000-0x0000000000460000-memory.dmp	family_redline
behavioral1/memory/4524-662-0x0000000000050000-0x0000000000070000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

F0geI.exekukurzka9000.exenamdoitntn.exereal.exesafert44.exetag.exejshainx.exeffnameedit.exerawxdev.exeme.exeMinecraftForge.exedllhost.exe

pid	process
3764	F0geI.exe
3696	kukurzka9000.exe
4800	namdoitntn.exe
4084	real.exe
4852	safert44.exe
5092	tag.exe
4200	jshainx.exe
4524	ffnameedit.exe
3304	rawxdev.exe
2184	me.exe
5280	MinecraftForge.exe
4660	dllhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

Processes:

cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\tag.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\rawxdev.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\me.exe	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe

Drops file in Windows directory 10 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

real.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	real.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3940 schtasks.exe

pid	process
3940	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = d581f14b6daed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fcfc48b4e1aed801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{6714B6A4-F31F-42D0-B066-41B7E0020092} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "367223470"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000006da6b9467d9f756f77b096ced68924ac45d9d74d015717f8c299fc4f7e9d51f6542e74a3c6a7177d6fb7bbc83f1476a9c6591897bc759052185dbcb0e3f2ac3e494f7a530ee57a70911fb1028018072120138b0dfb29a6af20b6	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7f8028b3e1aed801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = d581f14b6daed801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

real.exeffnameedit.exesafert44.exejshainx.exenamdoitntn.exeMinecraftForge.exepowershell.exedllhost.exe

pid	process
4084	real.exe
4084	real.exe
4524	ffnameedit.exe
4524	ffnameedit.exe
4852	safert44.exe
4852	safert44.exe
4200	jshainx.exe
4200	jshainx.exe
4800	namdoitntn.exe
4800	namdoitntn.exe
5280	MinecraftForge.exe
5280	MinecraftForge.exe
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe
4660	dllhost.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

MicrosoftEdgeCP.exe

pid	process
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeffnameedit.exesafert44.exejshainx.exenamdoitntn.exeMinecraftForge.exepowershell.exedllhost.exe

description	pid	process
Token: SeDebugPrivilege	4432	MicrosoftEdge.exe
Token: SeDebugPrivilege	4432	MicrosoftEdge.exe
Token: SeDebugPrivilege	4432	MicrosoftEdge.exe
Token: SeDebugPrivilege	4432	MicrosoftEdge.exe
Token: SeDebugPrivilege	4996	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4996	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4996	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4996	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5780	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5780	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4524	ffnameedit.exe
Token: SeDebugPrivilege	4852	safert44.exe
Token: SeDebugPrivilege	4200	jshainx.exe
Token: SeDebugPrivilege	4800	namdoitntn.exe
Token: SeDebugPrivilege	5280	MinecraftForge.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	4660	dllhost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

4432 MicrosoftEdge.exe
4320 MicrosoftEdgeCP.exe
4320 MicrosoftEdgeCP.exe

pid	process
4432	MicrosoftEdge.exe
4320	MicrosoftEdgeCP.exe
4320	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exeMicrosoftEdgeCP.exejshainx.exeMinecraftForge.execmd.exe

description	pid	process	target process
PID 2676 wrote to memory of 3764	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	F0geI.exe
PID 2676 wrote to memory of 3764	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	F0geI.exe
PID 2676 wrote to memory of 3764	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	F0geI.exe
PID 2676 wrote to memory of 3696	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	kukurzka9000.exe
PID 2676 wrote to memory of 3696	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	kukurzka9000.exe
PID 2676 wrote to memory of 3696	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	kukurzka9000.exe
PID 2676 wrote to memory of 4800	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	namdoitntn.exe
PID 2676 wrote to memory of 4800	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	namdoitntn.exe
PID 2676 wrote to memory of 4800	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	namdoitntn.exe
PID 2676 wrote to memory of 4084	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	real.exe
PID 2676 wrote to memory of 4084	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	real.exe
PID 2676 wrote to memory of 4084	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	real.exe
PID 2676 wrote to memory of 4852	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	safert44.exe
PID 2676 wrote to memory of 4852	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	safert44.exe
PID 2676 wrote to memory of 4852	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	safert44.exe
PID 2676 wrote to memory of 5092	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	tag.exe
PID 2676 wrote to memory of 5092	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	tag.exe
PID 2676 wrote to memory of 5092	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	tag.exe
PID 2676 wrote to memory of 4200	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	jshainx.exe
PID 2676 wrote to memory of 4200	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	jshainx.exe
PID 2676 wrote to memory of 4200	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	jshainx.exe
PID 2676 wrote to memory of 4524	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	ffnameedit.exe
PID 2676 wrote to memory of 4524	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	ffnameedit.exe
PID 2676 wrote to memory of 4524	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	ffnameedit.exe
PID 2676 wrote to memory of 3304	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	rawxdev.exe
PID 2676 wrote to memory of 3304	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	rawxdev.exe
PID 2676 wrote to memory of 3304	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	rawxdev.exe
PID 2676 wrote to memory of 2184	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	me.exe
PID 2676 wrote to memory of 2184	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	me.exe
PID 2676 wrote to memory of 2184	2676	cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe	me.exe
PID 4320 wrote to memory of 4996	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4996	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4996	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4996	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4576	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4576	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4576	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4576	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 660	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 660	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 660	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 660	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4836	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4836	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4836	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 4836	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 392	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 392	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 392	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 392	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 5068	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 5068	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 5068	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4320 wrote to memory of 5068	4320	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4200 wrote to memory of 5280	4200	jshainx.exe	MinecraftForge.exe
PID 4200 wrote to memory of 5280	4200	jshainx.exe	MinecraftForge.exe
PID 4200 wrote to memory of 5280	4200	jshainx.exe	MinecraftForge.exe
PID 5280 wrote to memory of 6096	5280	MinecraftForge.exe	cmd.exe
PID 5280 wrote to memory of 6096	5280	MinecraftForge.exe	cmd.exe
PID 5280 wrote to memory of 6096	5280	MinecraftForge.exe	cmd.exe
PID 6096 wrote to memory of 5204	6096	cmd.exe	chcp.com
PID 6096 wrote to memory of 5204	6096	cmd.exe	chcp.com
PID 6096 wrote to memory of 5204	6096	cmd.exe	chcp.com
PID 6096 wrote to memory of 1292	6096	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe
"C:\Users\Admin\AppData\Local\Temp\cd846ec4ec9c0f6e6078d73b1e32b2488179f597307bcdf1777388192e916d54.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2676

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
2⤵
- Executes dropped EXE
PID:3764

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
2⤵
- Executes dropped EXE
PID:3696

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Program Files (x86)\Company\NewProduct\safert44.exe
"C:\Program Files (x86)\Company\NewProduct\safert44.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files (x86)\Company\NewProduct\tag.exe
"C:\Program Files (x86)\Company\NewProduct\tag.exe"
2⤵
- Executes dropped EXE
PID:5092

C:\Program Files (x86)\Company\NewProduct\real.exe
"C:\Program Files (x86)\Company\NewProduct\real.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4084

C:\Program Files (x86)\Company\NewProduct\jshainx.exe
"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200

C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
4⤵
- Suspicious use of WriteProcessMemory
PID:6096

C:\Windows\SysWOW64\chcp.com
chcp 1251
5⤵
PID:5204

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\ProgramData\Dllhost\dllhost.exe
"C:\ProgramData\Dllhost\dllhost.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:6136

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
6⤵
- Creates scheduled task(s)
PID:3940

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5364

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5400

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5488

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5608

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2809" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5472

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4248" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5880

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7772" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5952

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6990" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5088

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:5672

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
5⤵
PID:4396

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
5⤵
PID:5472

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
5⤵
PID:5440

C:\Windows\SysWOW64\chcp.com
chcp 1251
6⤵
PID:1340

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
"C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"
2⤵
- Executes dropped EXE
PID:3304

C:\Program Files (x86)\Company\NewProduct\me.exe
"C:\Program Files (x86)\Company\NewProduct\me.exe"
2⤵
- Executes dropped EXE
PID:2184

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4432

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2052

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:3156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:392

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5068

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\F0geI.exe
Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Filesize
107KB

MD5
4bf892a854af9af2802f526837819f6e

SHA1
09f2e9938466e74a67368ecd613efdc57f80c30b

SHA256
713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf

SHA512
7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44

Download Submit
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe
Filesize
107KB

MD5
4bf892a854af9af2802f526837819f6e

SHA1
09f2e9938466e74a67368ecd613efdc57f80c30b

SHA256
713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf

SHA512
7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe
Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.4MB

MD5
8df3405e9cd1a18d10568e0d32e6dc39

SHA1
a084252242da8dbf97f23d7785fdf2b8d9677d3b

SHA256
79516c040ffbb1121904be5b09cd8a7e6fb78885dcc08a9e33781258680b639b

SHA512
6f3e242723983ea2d04d0857d88e2706d53ec9d9b8c030e25e28a60f70813bdd8a8082db60f70b79ed20d6544b8fc069b7fd096da78bbd64b08a5435adfbaa87

Download Submit
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
Filesize
1.4MB

MD5
8df3405e9cd1a18d10568e0d32e6dc39

SHA1
a084252242da8dbf97f23d7785fdf2b8d9677d3b

SHA256
79516c040ffbb1121904be5b09cd8a7e6fb78885dcc08a9e33781258680b639b

SHA512
6f3e242723983ea2d04d0857d88e2706d53ec9d9b8c030e25e28a60f70813bdd8a8082db60f70b79ed20d6544b8fc069b7fd096da78bbd64b08a5435adfbaa87

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe
Filesize
281KB

MD5
0856c11e41b1bf5e5aafb44fa4eaae4e

SHA1
3bb9039bbe89b2058c7c7d0537d7ddaa8f5d2826

SHA256
0721243b2d897a8734838ac4fbd402dab5a247a973f08fc82703a565c516911f

SHA512
f5605d5d0ef514dd6f571c30b79608a6ddbb8fb025c2750448a758295a0f3fc47a1b973aab0e061f8361b696c920ebb54073ef109cfd14cd08cdb98b9a1b7726

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe
Filesize
281KB

MD5
0856c11e41b1bf5e5aafb44fa4eaae4e

SHA1
3bb9039bbe89b2058c7c7d0537d7ddaa8f5d2826

SHA256
0721243b2d897a8734838ac4fbd402dab5a247a973f08fc82703a565c516911f

SHA512
f5605d5d0ef514dd6f571c30b79608a6ddbb8fb025c2750448a758295a0f3fc47a1b973aab0e061f8361b696c920ebb54073ef109cfd14cd08cdb98b9a1b7726

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
Filesize
1.2MB

MD5
919cf73749642aa08fb76e9254af5efa

SHA1
08c25ab3572b9035496aec516342e37a25a84883

SHA256
2a31d54ca5b61e6c51c9fb64f3c8d7f081ccd9f5bf525396101d68c3d6050db3

SHA512
5b632aa85adf0dafa2eacee4addd2329334ddf3d7f6c12e8bce2c302722c7ccd61cfac5fa194870e9f775b64275d8c9e14c9f160e3fbb6d0cc03f9432c9a28f6

Download Submit
C:\Program Files (x86)\Company\NewProduct\rawxdev.exe
Filesize
1.2MB

MD5
919cf73749642aa08fb76e9254af5efa

SHA1
08c25ab3572b9035496aec516342e37a25a84883

SHA256
2a31d54ca5b61e6c51c9fb64f3c8d7f081ccd9f5bf525396101d68c3d6050db3

SHA512
5b632aa85adf0dafa2eacee4addd2329334ddf3d7f6c12e8bce2c302722c7ccd61cfac5fa194870e9f775b64275d8c9e14c9f160e3fbb6d0cc03f9432c9a28f6

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
282KB

MD5
474861050e6a7b65bc4521096cb05454

SHA1
4e1aabe27598171a89c219aab860b325a4358b22

SHA256
ccd962957659555af7c607deb20a4ec34a1578af037d5310ffd07bd092f0ebc7

SHA512
42afff00dd616fc73d1c338184149ddb66376e808cd2da39a94357c8d296a245ab0f1e474aac1789d613efef3c1867e0c3a2e41c07ac21bcc07e00ea08309a79

Download Submit
C:\Program Files (x86)\Company\NewProduct\real.exe
Filesize
282KB

MD5
474861050e6a7b65bc4521096cb05454

SHA1
4e1aabe27598171a89c219aab860b325a4358b22

SHA256
ccd962957659555af7c607deb20a4ec34a1578af037d5310ffd07bd092f0ebc7

SHA512
42afff00dd616fc73d1c338184149ddb66376e808cd2da39a94357c8d296a245ab0f1e474aac1789d613efef3c1867e0c3a2e41c07ac21bcc07e00ea08309a79

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe
Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\Program Files (x86)\Company\NewProduct\tag.exe
Filesize
107KB

MD5
2ebc22860c7d9d308c018f0ffb5116ff

SHA1
78791a83f7161e58f9b7df45f9be618e9daea4cd

SHA256
8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89

SHA512
d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

Download Submit
C:\ProgramData\Dllhost\dllhost.exe
Filesize
951KB

MD5
2f65aa26f19b301f51a2d954f1c26821

SHA1
63acc00e697efdeaa57f7657e6d95758173e482e

SHA256
c01ed91474cdef0cd5d17a6b36a41c8ebc919abc133c04af3d1f4df67dfe590d

SHA512
af732f9cac31fde6de525faed92b468b38acda3ffca9c94f2c41f027b01e65dacc085c7d8563462f71d8573c2190a6014d79490e9cb0af5ca37ebf26a3aaa326

Download Submit
C:\ProgramData\Dllhost\dllhost.exe
Filesize
951KB

MD5
2f65aa26f19b301f51a2d954f1c26821

SHA1
63acc00e697efdeaa57f7657e6d95758173e482e

SHA256
c01ed91474cdef0cd5d17a6b36a41c8ebc919abc133c04af3d1f4df67dfe590d

SHA512
af732f9cac31fde6de525faed92b468b38acda3ffca9c94f2c41f027b01e65dacc085c7d8563462f71d8573c2190a6014d79490e9cb0af5ca37ebf26a3aaa326

Download Submit
C:\ProgramData\SystemFiles\sys_rh.bin
Filesize
1KB

MD5
0cdf43198d2721395850bbe27d83391f

SHA1
4d80abbc82b8ab42e0e798e61e2778445d2c2a1c

SHA256
9b8144e93a03858de025bd01b0bb5d6c757da4ec91343a5a2a8e3832606cea01

SHA512
7f7f393034d73c275adf92d61271e51c7156e8d5df19f76653ed1abebf44b2b40e48369daf5f9729bbd585b5f3c70f1abfdec31c777be134ef8c6cbf4c812907

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\4QO88DQ4.cookie
Filesize
336B

MD5
f84ae4d3758690f40e5a28fa64213f2f

SHA1
86e866f735ba9bf9850a80d425ddd29b76f5c1ff

SHA256
482c5456cc6a74ee735290bc63554b8d58234260e31664f6b37ccddfe58b8784

SHA512
382d6c04b3812a078aee34a87a51602f0847a30e143eaf544ddb327ca635c0687ddfcfe9eb59110cc0cc4b8bbb729bafb99b8894a75bd3e764dfc51bafa1ecaa

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\CI57PBZ4.cookie
Filesize
170B

MD5
a293ed10817bff24601f6698c4959c51

SHA1
4fdd8590904b1034d9314a1007f8297689384af7

SHA256
31f7518f8a7e14a8fe63e83fd3c0d17a8f64246f8306dc896aa594fe3d0eb6f7

SHA512
d19a4c6c7b4b687062fcc80295dbd61426135bf3c57d965a912245d6478a2c4ac8e50f38561c2248383d14eae767e02a12b8642b9ae8a27fff8df9d390aa3eee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\GVNWIFG6.cookie
Filesize
253B

MD5
888987d927c10643cacf100b2c4a968e

SHA1
90ab440d2d153d3d670e785a7025092ff998a2b5

SHA256
3abb4186bfdf788d4c016a82a0ecf85d0e6cdcb5b78f34ec9fcfb551275d79d7

SHA512
b1a869c97098e741524bf2463bd7bd3be258be443f987deb97f9bc75119dd08d915b74ea8f10a80dba40ffd95be205b9dde2c6b599dad6cc180ffc3f10f0e885

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\V34YONZG.cookie
Filesize
419B

MD5
6c3166fb0cb2c93595dfea0d1f11754d

SHA1
c617ff76647b1164d6213f2f5fc6bdb619edcf14

SHA256
fff303e471b208cd5884048521368b68cdf9378368dec950f805edb0a8f3321e

SHA512
bbf02f8448523d48a360cc00de27474a459e24c323e80ce89e959df8a11917f3b26835ec6b8be44b88a77f49f8a4964fcec760548d790021ddedcee12b520751

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\VNO79VMV.cookie
Filesize
502B

MD5
d26c7e3913caa3e174b5810c130ec2d6

SHA1
a20f4a83df74b271548ebac76a13a6f725db51ca

SHA256
ae9d673fbc33293ed13b25f58011de24dbc7447e80680f66f3b3702172dc8488

SHA512
adbb98318193f3520a51fed46522d0bf442060b48ea004b3e0e02e16d563e4caa544ea41889e557ef022d9c62d5569bc423c4772e9d01e2b8018f23d8f9c61fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
3fd34f4434078c44be3a336c9e39fac3

SHA1
a9162af9cd48e8a183964b481aadc2e670c9fa2d

SHA256
f919972fb6c52a862b033c655cad6a19e34984d1c317cf7de341d753df66829a

SHA512
624ece0d2ae34f6f79775c974f2fe441b916ef3805306cfe269bdc74881ea36c38643f0caca7d2a749035dfbee0b0e8a6304f689091ed80271eb5c87c3dd2e0b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
3fd34f4434078c44be3a336c9e39fac3

SHA1
a9162af9cd48e8a183964b481aadc2e670c9fa2d

SHA256
f919972fb6c52a862b033c655cad6a19e34984d1c317cf7de341d753df66829a

SHA512
624ece0d2ae34f6f79775c974f2fe441b916ef3805306cfe269bdc74881ea36c38643f0caca7d2a749035dfbee0b0e8a6304f689091ed80271eb5c87c3dd2e0b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
04b849b9d86db9e7ade79b592e901075

SHA1
69c78403e42ff7f6d5c6d9398a00b94a9d46009d

SHA256
c3a56c0e7a728462ae65cf160e225db1eed212b6bdc25204a9b24841ff40e8ee

SHA512
260d7b8f49230326fd882d8865aaddb27520d8d7485005e61e6d7f01c279adad1f2c103a5e72aca5b3a8d036e68aeb26934461acabca979d8e1e9396bd9435df

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
04b849b9d86db9e7ade79b592e901075

SHA1
69c78403e42ff7f6d5c6d9398a00b94a9d46009d

SHA256
c3a56c0e7a728462ae65cf160e225db1eed212b6bdc25204a9b24841ff40e8ee

SHA512
260d7b8f49230326fd882d8865aaddb27520d8d7485005e61e6d7f01c279adad1f2c103a5e72aca5b3a8d036e68aeb26934461acabca979d8e1e9396bd9435df

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
81173cc7e36f607a6418c5ed42794566

SHA1
3a0a3ab93c75e9f2f735943aa73955d28e73d359

SHA256
d6a7430793736bab01094219f7ea430585e65b76dcde9009183dab6121a1cabf

SHA512
0e6ac8720f302542c83103961fb9604ecd2c7f9203647585e1f935f0bc02a5a035ce03faedf532736e6040717c9863c33d945fa642de1cd76eba3b6bc806a461

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
Filesize
71KB

MD5
f8370d132f334be6703ce54b08db1578

SHA1
55d98f702724f25535bfbeb7a46cee92d57a4421

SHA256
2b058754c1b4402ccc99db8e247f234593bb96015af801f2ee6880425b126fb6

SHA512
0eee39de1ffb965744c97a1c6918ccd755a4fae18d889893244e9d0e3760f28615e46cce524930f1d9f18540bbd6644cd45765c8f95f04c615a0ff682136b35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MinecraftForge.exe
Filesize
71KB

MD5
f8370d132f334be6703ce54b08db1578

SHA1
55d98f702724f25535bfbeb7a46cee92d57a4421

SHA256
2b058754c1b4402ccc99db8e247f234593bb96015af801f2ee6880425b126fb6

SHA512
0eee39de1ffb965744c97a1c6918ccd755a4fae18d889893244e9d0e3760f28615e46cce524930f1d9f18540bbd6644cd45765c8f95f04c615a0ff682136b35b

Download Submit
memory/1292-1234-0x00000000099B0000-0x00000000099E3000-memory.dmp

Filesize
204KB

Download
memory/1292-1248-0x0000000009EE0000-0x0000000009F74000-memory.dmp

Filesize
592KB

Download
memory/1292-1632-0x0000000009DC0000-0x0000000009DC8000-memory.dmp

Filesize
32KB

Download
memory/1292-1213-0x00000000082D0000-0x00000000082EC000-memory.dmp

Filesize
112KB

Download
memory/1292-1196-0x0000000007AC0000-0x0000000007B26000-memory.dmp

Filesize
408KB

Download
memory/1292-1235-0x0000000009990000-0x00000000099AE000-memory.dmp

Filesize
120KB

Download
memory/1292-1244-0x0000000009A00000-0x0000000009AA5000-memory.dmp

Filesize
660KB

Download
memory/1292-1202-0x0000000008300000-0x0000000008650000-memory.dmp

Filesize
3.3MB

Download
memory/1292-1165-0x0000000005300000-0x0000000005336000-memory.dmp

Filesize
216KB

Download
memory/1292-1129-0x0000000000000000-mapping.dmp

Download
memory/1292-1170-0x0000000007BA0000-0x00000000081C8000-memory.dmp

Filesize
6.2MB

Download
memory/1292-1189-0x0000000007A20000-0x0000000007A42000-memory.dmp

Filesize
136KB

Download
memory/1292-1627-0x0000000009E00000-0x0000000009E1A000-memory.dmp

Filesize
104KB

Download
memory/1340-1714-0x0000000000000000-mapping.dmp

Download
memory/2184-779-0x0000000000000000-mapping.dmp

Download
memory/2676-160-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-129-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-171-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-172-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-173-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-174-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-175-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-176-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-177-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-178-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-179-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-169-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-117-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-168-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-118-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-167-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-119-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-166-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-165-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-164-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-163-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-162-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-120-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-161-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-121-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-116-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-159-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-122-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-123-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-124-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-158-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-157-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-156-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-155-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-154-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-153-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-152-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-151-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-150-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-149-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-148-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-125-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-126-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-127-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-128-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-170-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-130-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-147-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-146-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-131-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-132-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-133-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-145-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-134-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-135-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-136-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-137-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-138-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-144-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-143-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-139-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-142-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-140-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-141-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/3304-610-0x0000000000000000-mapping.dmp

Download
memory/3696-810-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/3696-801-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/3696-797-0x0000000002340000-0x0000000002352000-memory.dmp

Filesize
72KB

Download
memory/3696-302-0x0000000000000000-mapping.dmp

Download
memory/3764-933-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3764-914-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/3764-932-0x00000000004F0000-0x000000000063A000-memory.dmp

Filesize
1.3MB

Download
memory/3764-575-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/3764-567-0x00000000004F0000-0x000000000063A000-memory.dmp

Filesize
1.3MB

Download
memory/3764-629-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3764-301-0x0000000000000000-mapping.dmp

Download
memory/3940-1592-0x0000000000000000-mapping.dmp

Download
memory/4084-311-0x0000000000000000-mapping.dmp

Download
memory/4200-936-0x0000000005040000-0x00000000050A6000-memory.dmp

Filesize
408KB

Download
memory/4200-646-0x0000000000440000-0x0000000000460000-memory.dmp

Filesize
128KB

Download
memory/4200-989-0x00000000068D0000-0x0000000006920000-memory.dmp

Filesize
320KB

Download
memory/4200-375-0x0000000000000000-mapping.dmp

Download
memory/4396-1462-0x0000000000000000-mapping.dmp

Download
memory/4524-662-0x0000000000050000-0x0000000000070000-memory.dmp

Filesize
128KB

Download
memory/4524-381-0x0000000000000000-mapping.dmp

Download
memory/4660-1394-0x0000000000B50000-0x0000000000C44000-memory.dmp

Filesize
976KB

Download
memory/4660-1324-0x0000000000000000-mapping.dmp

Download
memory/4660-1410-0x0000000001520000-0x0000000001526000-memory.dmp

Filesize
24KB

Download
memory/4800-576-0x0000000000260000-0x0000000000280000-memory.dmp

Filesize
128KB

Download
memory/4800-751-0x00000000052E0000-0x00000000053EA000-memory.dmp

Filesize
1.0MB

Download
memory/4800-306-0x0000000000000000-mapping.dmp

Download
memory/4852-974-0x00000000067E0000-0x00000000069A2000-memory.dmp

Filesize
1.8MB

Download
memory/4852-978-0x0000000008390000-0x00000000088BC000-memory.dmp

Filesize
5.2MB

Download
memory/4852-317-0x0000000000000000-mapping.dmp

Download
memory/4852-935-0x0000000006110000-0x000000000660E000-memory.dmp

Filesize
5.0MB

Download
memory/4852-655-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/4852-581-0x0000000000160000-0x00000000001A4000-memory.dmp

Filesize
272KB

Download
memory/4852-937-0x0000000004EC0000-0x0000000004F36000-memory.dmp

Filesize
472KB

Download
memory/4852-939-0x0000000004FE0000-0x0000000005072000-memory.dmp

Filesize
584KB

Download
memory/4852-951-0x0000000004FA0000-0x0000000004FBE000-memory.dmp

Filesize
120KB

Download
memory/5028-1470-0x0000000000000000-mapping.dmp

Download
memory/5088-1525-0x0000000000000000-mapping.dmp

Download
memory/5092-784-0x0000000005720000-0x000000000576B000-memory.dmp

Filesize
300KB

Download
memory/5092-768-0x00000000056E0000-0x000000000571E000-memory.dmp

Filesize
248KB

Download
memory/5092-739-0x0000000005BF0000-0x00000000061F6000-memory.dmp

Filesize
6.0MB

Download
memory/5092-585-0x0000000000E70000-0x0000000000E90000-memory.dmp

Filesize
128KB

Download
memory/5092-323-0x0000000000000000-mapping.dmp

Download
memory/5092-744-0x0000000005680000-0x0000000005692000-memory.dmp

Filesize
72KB

Download
memory/5204-1121-0x0000000000000000-mapping.dmp

Download
memory/5280-1074-0x0000000000EA0000-0x0000000000EB8000-memory.dmp

Filesize
96KB

Download
memory/5280-1081-0x0000000005640000-0x0000000005646000-memory.dmp

Filesize
24KB

Download
memory/5280-1098-0x000000000AD60000-0x000000000AD6A000-memory.dmp

Filesize
40KB

Download
memory/5280-1027-0x0000000000000000-mapping.dmp

Download
memory/5364-1465-0x0000000000000000-mapping.dmp

Download
memory/5400-1476-0x0000000000000000-mapping.dmp

Download
memory/5440-1708-0x0000000000000000-mapping.dmp

Download
memory/5472-1505-0x0000000000000000-mapping.dmp

Download
memory/5472-1642-0x0000000000000000-mapping.dmp

Download
memory/5488-1483-0x0000000000000000-mapping.dmp

Download
memory/5608-1491-0x0000000000000000-mapping.dmp

Download
memory/5672-1497-0x0000000000000000-mapping.dmp

Download
memory/5880-1513-0x0000000000000000-mapping.dmp

Download
memory/5952-1519-0x0000000000000000-mapping.dmp

Download
memory/6096-1115-0x0000000000000000-mapping.dmp

Download
memory/6136-1458-0x0000000000000000-mapping.dmp

Download