redline | d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9

Analysis

max time kernel
150s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
27-09-2022 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe
Size

328KB
MD5

ed610eacae33e876b8dcce69b94ec41d
SHA1

bdc5ebaf624325366cefec5c56151cde98b83ba7
SHA256

d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9
SHA512

c6e08354acb5c27143cd38cf04634522c2f5c439bd01f750b77a6fe721f0ad30dafd72ee9319e4ae1e5db41a36770f21bbdb930c166f2a374928f93d1f4ff0ae
SSDEEP

6144:Qp8/r00tCZvd4ULzolg0ECIfKhnigabwVfs:Qp8Y0tm14UL47iB

Score

10^/10

redline smokeloader 11 inslab26 backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

51.89.201.21:7161

Attributes

auth_value
e6aadafed1fda7723d7655a5894828d2

Extracted

Family

redline

Botnet

inslab26

185.182.194.25:8251

Attributes

auth_value
7c9cbd0e489a3c7fd31006406cb96f5b

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4124-151-0x0000000000810000-0x0000000000819000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/102828-275-0x0000000000422112-mapping.dmp	family_redline
behavioral1/memory/102828-321-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

MoUSO.exesetup1.exesetup1.exesetup1.exesetup1.exesetup1.exesetup1.exesetup1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MoUSO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup1.exe

Downloads MZ/PE file

Executes dropped EXE 22 IoCs

Processes:

D517.exeib.exeE8A0.exeF459.exe134C.exesetup.exesetup.exesetup.exesetup1.exesetup.exesetup1.exesetup1.exesetup.exeMoUSO.exesetup1.exesetup.exesetup1.exesetup.exesetup1.exesetup.exesetup1.exesetup.exe

pid	process
3764	D517.exe
4544	ib.exe
2252	E8A0.exe
102992	F459.exe
3308	134C.exe
7984	setup.exe
8832	setup.exe
9020	setup.exe
9104	setup1.exe
9780	setup.exe
9860	setup1.exe
10720	setup1.exe
10844	setup.exe
11368	MoUSO.exe
11700	setup1.exe
11752	setup.exe
12116	setup1.exe
12240	setup.exe
12520	setup1.exe
12644	setup.exe
12992	setup1.exe
13156	setup.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup1.exesetup1.exesetup1.exesetup1.exesetup1.exesetup1.exeMoUSO.exesetup1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MoUSO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup1.exe

Deletes itself 1 IoCs

Processes:

pid process

3048

pid	process
3048

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

setup1.exesetup1.exesetup1.exesetup1.exesetup1.exesetup1.exesetup1.exeMoUSO.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	setup1.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Wine	MoUSO.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YWVOBXSF\vv[1].exe	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

setup1.exesetup1.exesetup1.exeMoUSO.exesetup1.exesetup1.exesetup1.exesetup1.exe

pid process

9104 setup1.exe
9860 setup1.exe
10720 setup1.exe
11368 MoUSO.exe
11700 setup1.exe
12116 setup1.exe
12520 setup1.exe
12992 setup1.exe

pid	process
9104	setup1.exe
9860	setup1.exe
10720	setup1.exe
11368	MoUSO.exe
11700	setup1.exe
12116	setup1.exe
12520	setup1.exe
12992	setup1.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

ib.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exe

description	pid	process	target process
PID 4544 set thread context of 102828	4544	ib.exe	AppLaunch.exe
PID 7984 set thread context of 8184	7984	setup.exe	RegSvcs.exe
PID 8832 set thread context of 8884	8832	setup.exe	RegSvcs.exe
PID 9020 set thread context of 9072	9020	setup.exe	RegSvcs.exe
PID 9780 set thread context of 9832	9780	setup.exe	RegSvcs.exe
PID 10844 set thread context of 10896	10844	setup.exe	RegSvcs.exe
PID 11752 set thread context of 11848	11752	setup.exe	RegSvcs.exe
PID 12240 set thread context of 12396	12240	setup.exe	RegSvcs.exe
PID 12644 set thread context of 12696	12644	setup.exe	RegSvcs.exe
PID 13156 set thread context of 13208	13156	setup.exe	RegSvcs.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

9608 schtasks.exe
10360 schtasks.exe
11268 schtasks.exe

pid	process
9608	schtasks.exe
10360	schtasks.exe
11268	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Universal Phone Converter"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a75c006aacd2d801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "409;9"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Male"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestrealprizes.life\NumberOf = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000009b4e42eef3de11bed549ff21fcb49247cb6f7540574be6bfc09478ce8424835a4231cf33f8d69701cd8167d525ad898398a64016aa45fef25ac5761c29338ab79f24b55f009c966db352d98ceab99a492e6f41dd0d6da2c3a23a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\lsr1033.lxa"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "11.0.2013.1022"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestrealprizes.life\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "371092350"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 + 0008 * 0009 1 000A 2 000B 3 000C 4 000D 5 000E a 000F ai 0010 an 0011 ang 0012 ao 0013 ba 0014 bai 0015 ban 0016 bang 0017 bao 0018 bei 0019 ben 001A beng 001B bi 001C bian 001D biao 001E bie 001F bin 0020 bing 0021 bo 0022 bu 0023 ca 0024 cai 0025 can 0026 cang 0027 cao 0028 ce 0029 cen 002A ceng 002B cha 002C chai 002D chan 002E chang 002F chao 0030 che 0031 chen 0032 cheng 0033 chi 0034 chong 0035 chou 0036 chu 0037 chuai 0038 chuan 0039 chuang 003A chui 003B chun 003C chuo 003D ci 003E cong 003F cou 0040 cu 0041 cuan 0042 cui 0043 cun 0044 cuo 0045 da 0046 dai 0047 dan 0048 dang 0049 dao 004A de 004B dei 004C den 004D deng 004E di 004F dia 0050 dian 0051 diao 0052 die 0053 ding 0054 diu 0055 dong 0056 dou 0057 du 0058 duan 0059 dui 005A dun 005B duo 005C e 005D ei 005E en 005F er 0060 fa 0061 fan 0062 fang 0063 fei 0064 fen 0065 feng 0066 fo 0067 fou 0068 fu 0069 ga 006A gai 006B gan 006C gang 006D gao 006E ge 006F gei 0070 gen 0071 geng 0072 gong 0073 gou 0074 gu 0075 gua 0076 guai 0077 guan 0078 guang 0079 gui 007A gun 007B guo 007C ha 007D hai 007E han 007F hang 0080 hao 0081 he 0082 hei 0083 hen 0084 heng 0085 hong 0086 hou 0087 hu 0088 hua 0089 huai 008A huan 008B huang 008C hui 008D hun 008E huo 008F ji 0090 jia 0091 jian 0092 jiang 0093 jiao 0094 jie 0095 jin 0096 jing 0097 jiong 0098 jiu 0099 ju 009A juan 009B jue 009C jun 009D ka 009E kai 009F kan 00A0 kang 00A1 kao 00A2 ke 00A3 kei 00A4 ken 00A5 keng 00A6 kong 00A7 kou 00A8 ku 00A9 kua 00AA kuai 00AB kuan 00AC kuang 00AD kui 00AE kun 00AF kuo 00B0 la 00B1 lai 00B2 lan 00B3 lang 00B4 lao 00B5 le 00B6 lei 00B7 leng 00B8 li 00B9 lia 00BA lian 00BB liang 00BC liao 00BD lie 00BE lin 00BF ling 00C0 liu 00C1 lo 00C2 long 00C3 lou 00C4 lu 00C5 luan 00C6 lue 00C7 lun 00C8 luo 00C9 lv 00CA ma 00CB mai 00CC man 00CD mang 00CE mao 00CF me 00D0 mei 00D1 men 00D2 meng 00D3 mi 00D4 mian 00D5 miao 00D6 mie 00D7 min 00D8 ming 00D9 miu 00DA mo 00DB mou 00DC mu 00DD na 00DE nai 00DF nan 00E0 nang 00E1 nao 00E2 ne 00E3 nei 00E4 nen 00E5 neng 00E6 ni 00E7 nian 00E8 niang 00E9 niao 00EA nie 00EB nin 00EC ning 00ED niu 00EE nong 00EF nou 00F0 nu 00F1 nuan 00F2 nue 00F3 nuo 00F4 nv 00F5 o 00F6 ou 00F7 pa 00F8 pai 00F9 pan 00FA pang 00FB pao 00FC pei 00FD pen 00FE peng 00FF pi 0100 pian 0101 piao 0102 pie 0103 pin 0104 ping 0105 po 0106 pou 0107 pu 0108 qi 0109 qia 010A qian 010B qiang 010C qiao 010D qie 010E qin 010F qing 0110 qiong 0111 qiu 0112 qu 0113 quan 0114 que 0115 qun 0116 ran 0117 rang 0118 rao 0119 re 011A ren 011B reng 011C ri 011D rong 011E rou 011F ru 0120 ruan 0121 rui 0122 run 0123 ruo 0124 sa 0125 sai 0126 san 0127 sang 0128 sao 0129 se 012A sen 012B seng 012C sha 012D shai 012E shan 012F shang 0130 shao 0131 she 0132 shei 0133 shen 0134 sheng 0135 shi 0136 shou 0137 shu 0138 shua 0139 shuai 013A shuan 013B shuang 013C shui 013D shun 013E shuo 013F si 0140 song 0141 sou 0142 su 0143 suan 0144 sui 0145 sun 0146 suo 0147 ta 0148 tai 0149 tan 014A tang 014B tao 014C te 014D tei 014E teng 014F ti 0150 tian 0151 tiao 0152 tie 0153 ting 0154 tong 0155 tou 0156 tu 0157 tuan 0158 tui 0159 tun 015A tuo 015B wa 015C wai 015D wan 015E wang 015F wei 0160 wen 0161 weng 0162 wo 0163 wu 0164 xi 0165 xia 0166 xian 0167 xiang 0168 xiao 0169 xie 016A xin 016B xing 016C xiong 016D xiu 016E xu 016F xuan 0170 xue 0171 xun 0172 ya 0173 yan 0174 yang 0175 yao 0176 ye 0177 yi 0178 yin 0179 ying 017A yo 017B yong 017C you 017D yu 017E yuan 017F yue 0180 yun 0181 za 0182 zai 0183 zan 0184 zang 0185 zao 0186 ze 0187 zei 0188 zen 0189 zeng 018A zha 018B zhai 018C zhan 018D zhang 018E zhao 018F zhe 0190 zhei 0191 zhen 0192 zheng 0193 zhi 0194 zhong 0195 zhou 0196 zhu 0197 zhua 0198 zhuai 0199 zhuan 019A zhuang 019B zhui 019C zhun 019D zhuo 019E zi 019F zong 01A0 zou 01A1 zu 01A2 zuan 01A3 zui 01A4 zun 01A5 zuo 01A6"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{37A9D401-0BF5-4366-9530-C75C6DC23EC9}"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 aa 000a ae 000b ah 000c ao 000d aw 000e ax 000f ay 0010 b 0011 ch 0012 d 0013 dh 0014 eh 0015 er 0016 ey 0017 f 0018 g 0019 h 001a ih 001b iy 001c jh 001d k 001e l 001f m 0020 n 0021 ng 0022 ow 0023 oy 0024 p 0025 r 0026 s 0027 sh 0028 t 0029 th 002a uh 002b uw 002c v 002d w 002e y 002f z 0030 zh 0031"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "SR en-US Lookup Lexicon"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "German Phone Converter"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "411"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7332186aacd2d801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "SR en-US Lts Lexicon"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "L1033"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Software\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestrealprizes.life\NumberOf = "1"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe

pid	process
4124	d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe
4124	d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3048

pid	process
3048

Suspicious behavior: MapViewOfSection 41 IoCs

Processes:

d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exeexplorer.exeexplorer.exeMicrosoftEdgeCP.exe

pid	process
4124	d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
1288	explorer.exe
1288	explorer.exe
1288	explorer.exe
1288	explorer.exe
4332	explorer.exe
4332	explorer.exe
4332	explorer.exe
4332	explorer.exe
7704	MicrosoftEdgeCP.exe
7704	MicrosoftEdgeCP.exe
1288	explorer.exe
1288	explorer.exe
4332	explorer.exe
4332	explorer.exe
1288	explorer.exe
1288	explorer.exe
4332	explorer.exe
4332	explorer.exe
1288	explorer.exe
1288	explorer.exe
4332	explorer.exe
4332	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

E8A0.exeAppLaunch.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	2252	E8A0.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	102828	AppLaunch.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeTakeOwnershipPrivilege	3048
Token: SeRestorePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	7240	MicrosoftEdge.exe
Token: SeDebugPrivilege	7240	MicrosoftEdge.exe
Token: SeDebugPrivilege	7240	MicrosoftEdge.exe
Token: SeDebugPrivilege	7240	MicrosoftEdge.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	7808	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	7808	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3048
7240 MicrosoftEdge.exe
7704 MicrosoftEdgeCP.exe
7704 MicrosoftEdgeCP.exe

pid	process
3048
7240	MicrosoftEdge.exe
7704	MicrosoftEdgeCP.exe
7704	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

D517.exeib.exeAppLaunch.exesetup.exe

description	pid	process	target process
PID 3048 wrote to memory of 3764	3048		D517.exe
PID 3048 wrote to memory of 3764	3048		D517.exe
PID 3048 wrote to memory of 3764	3048		D517.exe
PID 3764 wrote to memory of 4544	3764	D517.exe	ib.exe
PID 3764 wrote to memory of 4544	3764	D517.exe	ib.exe
PID 3764 wrote to memory of 4544	3764	D517.exe	ib.exe
PID 3048 wrote to memory of 2252	3048		E8A0.exe
PID 3048 wrote to memory of 2252	3048		E8A0.exe
PID 3048 wrote to memory of 2252	3048		E8A0.exe
PID 4544 wrote to memory of 102828	4544	ib.exe	AppLaunch.exe
PID 4544 wrote to memory of 102828	4544	ib.exe	AppLaunch.exe
PID 4544 wrote to memory of 102828	4544	ib.exe	AppLaunch.exe
PID 4544 wrote to memory of 102828	4544	ib.exe	AppLaunch.exe
PID 4544 wrote to memory of 102828	4544	ib.exe	AppLaunch.exe
PID 3048 wrote to memory of 102992	3048		F459.exe
PID 3048 wrote to memory of 102992	3048		F459.exe
PID 3048 wrote to memory of 102992	3048		F459.exe
PID 3048 wrote to memory of 3308	3048		134C.exe
PID 3048 wrote to memory of 3308	3048		134C.exe
PID 3048 wrote to memory of 3308	3048		134C.exe
PID 3048 wrote to memory of 1516	3048		explorer.exe
PID 3048 wrote to memory of 1516	3048		explorer.exe
PID 3048 wrote to memory of 1516	3048		explorer.exe
PID 3048 wrote to memory of 1516	3048		explorer.exe
PID 3048 wrote to memory of 1288	3048		explorer.exe
PID 3048 wrote to memory of 1288	3048		explorer.exe
PID 3048 wrote to memory of 1288	3048		explorer.exe
PID 3048 wrote to memory of 976	3048		explorer.exe
PID 3048 wrote to memory of 976	3048		explorer.exe
PID 3048 wrote to memory of 976	3048		explorer.exe
PID 3048 wrote to memory of 976	3048		explorer.exe
PID 3048 wrote to memory of 4332	3048		explorer.exe
PID 3048 wrote to memory of 4332	3048		explorer.exe
PID 3048 wrote to memory of 4332	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 2244	3048		explorer.exe
PID 3048 wrote to memory of 2244	3048		explorer.exe
PID 3048 wrote to memory of 2244	3048		explorer.exe
PID 3048 wrote to memory of 2244	3048		explorer.exe
PID 3048 wrote to memory of 5168	3048		explorer.exe
PID 3048 wrote to memory of 5168	3048		explorer.exe
PID 3048 wrote to memory of 5168	3048		explorer.exe
PID 3048 wrote to memory of 5168	3048		explorer.exe
PID 3048 wrote to memory of 5372	3048		explorer.exe
PID 3048 wrote to memory of 5372	3048		explorer.exe
PID 3048 wrote to memory of 5372	3048		explorer.exe
PID 3048 wrote to memory of 5584	3048		explorer.exe
PID 3048 wrote to memory of 5584	3048		explorer.exe
PID 3048 wrote to memory of 5584	3048		explorer.exe
PID 3048 wrote to memory of 5584	3048		explorer.exe
PID 102828 wrote to memory of 7984	102828	AppLaunch.exe	setup.exe
PID 102828 wrote to memory of 7984	102828	AppLaunch.exe	setup.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe
PID 7984 wrote to memory of 8184	7984	setup.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe
"C:\Users\Admin\AppData\Local\Temp\d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4124

C:\Users\Admin\AppData\Local\Temp\D517.exe
C:\Users\Admin\AppData\Local\Temp\D517.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\Temp\ib.exe
"C:\Windows\Temp\ib.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:102828

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:7984

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
5⤵
PID:8184

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:8832

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
7⤵
PID:8884

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:9020

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
9⤵
PID:9072

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:9780

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
11⤵
PID:9832

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:10844

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
13⤵
PID:10896

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:11752

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
15⤵
PID:11848

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:12240

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
17⤵
PID:12396

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:12644

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
19⤵
PID:12696

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:13156

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
21⤵
PID:13208

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
18⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:12992

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
16⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:12520

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
14⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:12116

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:11700

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
10⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:10720

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
11⤵
- Creates scheduled task(s)
PID:11268

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
8⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9860

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
9⤵
- Creates scheduled task(s)
PID:10360

C:\Users\Admin\AppData\Local\Temp\setup1.exe
"C:\Users\Admin\AppData\Local\Temp\setup1.exe"
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9104

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"
7⤵
- Creates scheduled task(s)
PID:9608

C:\Users\Admin\AppData\Local\Temp\E8A0.exe
C:\Users\Admin\AppData\Local\Temp\E8A0.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Users\Admin\AppData\Local\Temp\F459.exe
C:\Users\Admin\AppData\Local\Temp\F459.exe
1⤵
- Executes dropped EXE
PID:102992

C:\Users\Admin\AppData\Local\Temp\134C.exe
C:\Users\Admin\AppData\Local\Temp\134C.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1516

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:1288

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:976

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4332

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3364

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2244

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5168

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5372

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5584

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:7240

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:7284

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:7704

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:7808

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:10608

C:\Users\Admin\AppData\Local\cache\MoUSO.exe
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:11368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
922a04002a52165b0c0b27f79ed974bc

SHA1
1ff341fef63201a2f4d9d9745bdab5efe4a0ead5

SHA256
9b0fa20acda490feeacb2b19e45d61c6193f1c240062c778945a51c4621a1619

SHA512
fed81f3f34f94e6d3bb41e7b3135132f2ea2ca4e7e1325335a358c889dc77512981d3de6177e39b552c3502e5eb72a7545f2aef01e2400c3c1e691c6ce4b5074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_B0B75E4FA8953592512F0FA436A73A4E
Filesize
280B

MD5
443ca80aa373ff665d394e5dafef1a04

SHA1
798da79cb421bce4b433a891aeebae69c255ca23

SHA256
f8b2aa50f995cfc974303d1fa867177be2fcd55fac44750772f3f6a243603987

SHA512
81204514310fdb8c7d7a6b2f6d41704b1a57d566b85bb478d6221349589907b6837b03a51f3f3238d44440f4237a6d7a19b289f88e9f624931ae26e77c571210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
549e25f828fef968aafb5d9787b3d1a4

SHA1
d1c98b92f894165c767aa6f45ce468d2bf4125d8

SHA256
d1dc99c3208e0e6b59abb96fafc93d0c46e50961231b1637f5403a3d33bcbf76

SHA512
0f023aaa524b7fec260e4ab69a66e6abf57b4bf3e2720d70d54a626fa1ed2bac11044df95769aa31c3db7ab5deaa155315f33e83b9b99fd70973927d51d39208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_B0B75E4FA8953592512F0FA436A73A4E
Filesize
396B

MD5
eb26d25416d0539ce17df00b69f76bb8

SHA1
eec5f7fc48495111584f055c522217c7d8825a23

SHA256
040d5c1df24c0e0c8b492dab17477f2f7d83ebd0517fb9bed44831b81dc5506c

SHA512
7f57d84dfcfccbd30ddea5de4ec6065b64a8c6a3610265914bfb1df59305afb50ca82ba936729c681b5f626440c8e1cbb2e8fdf3c4e9e35e2a4b6c03c0929556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1GC1WEZG\configure[1].php
Filesize
1B

MD5
26b17225b626fb9238849fd60eabdf60

SHA1
a979ef10cc6f6a36df6b8a323307ee3bb2e2db9c

SHA256
a318c24216defe206feeb73ef5be00033fa9c4a74d0b967f6532a26ca5906d3b

SHA512
603e4eaa411769b6d83a13bf2fde63289322343f8c683ff61d832201e1cf4d3e432a1d9819e327fe14da61ab65ee70dee39d4a3f88a71530bde2cae73d36710b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5KFN9HPU\configure[1].php
Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5KFN9HPU\configure[1].php
Filesize
1B

MD5
26b17225b626fb9238849fd60eabdf60

SHA1
a979ef10cc6f6a36df6b8a323307ee3bb2e2db9c

SHA256
a318c24216defe206feeb73ef5be00033fa9c4a74d0b967f6532a26ca5906d3b

SHA512
603e4eaa411769b6d83a13bf2fde63289322343f8c683ff61d832201e1cf4d3e432a1d9819e327fe14da61ab65ee70dee39d4a3f88a71530bde2cae73d36710b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GCH1MNDX\sdf[1].exe
Filesize
1.3MB

MD5
08aaea4897cc79af999185ad736ba51f

SHA1
b99a16665233d55e359f3b9cac74c07b848697fe

SHA256
a3170a861e10689f87aee8296d8108be303a4993b7a8a0916dc0a4db14e0bbdf

SHA512
727c3fe70f861b2b633c6d700cb044359a33273fb54cdadd3b297744fc5f2e4d6cb08f1a6b574d7f1956674b7184b358f4de9cf82a5ee390e003220e8603af0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YWVOBXSF\configure[1].php
Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YWVOBXSF\vv[1].exe
Filesize
7.9MB

MD5
8f76cc737082cc709dd4c9106c671ab6

SHA1
ba5de16d94e73b551f0c6e5d81eb8ee9d8093d11

SHA256
35e3c1ca2fe9cee18e79de1b02972b0d010320a54e20113b7cb2ba063690f21e

SHA512
b88ef3536b8af9677d189d5ed6fee9bdb0cda0e356bb4108ccf8f52211a5ac85b183f3edff3a8e723e79b6dfdce87d1450cdad5790cea35abfd283ed159f6ec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\134C.exe
Filesize
510KB

MD5
15e5d66f6e75fb6f2b84c49ae053220c

SHA1
87e26ea8086a843782d5ab11b887ecf981c6c694

SHA256
03e229bd742a359f2180eb22d90f984127237dfeaefa4a8fc706d2845a7326b9

SHA512
a11147c1be557d84c09fe76f9e109c45be9f5dbb6a784c6ff8f18a603ec3769d37422054c85d8c3d153aa98170b5a69dff72416636d1bbb62f060f257afcadbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\134C.exe
Filesize
510KB

MD5
15e5d66f6e75fb6f2b84c49ae053220c

SHA1
87e26ea8086a843782d5ab11b887ecf981c6c694

SHA256
03e229bd742a359f2180eb22d90f984127237dfeaefa4a8fc706d2845a7326b9

SHA512
a11147c1be557d84c09fe76f9e109c45be9f5dbb6a784c6ff8f18a603ec3769d37422054c85d8c3d153aa98170b5a69dff72416636d1bbb62f060f257afcadbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\D517.exe
Filesize
877KB

MD5
519568e4e72de140be611b11df556faa

SHA1
aa31a4d3332fd13014e87ae2eca996e6390c6d16

SHA256
21b3ac9b55d1dabedfd9880caaf1dcabee6a914734e125a7a8e72cb1e7cc4f94

SHA512
24d145656ce7f22478e64d5e937c065471a1ad39da4a33f8b9e3dfb52b1a7dcc10d54b3b212e6e82969db4269b730e5b90b7d8fd35919deabc3f09fcc5890a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\D517.exe
Filesize
877KB

MD5
519568e4e72de140be611b11df556faa

SHA1
aa31a4d3332fd13014e87ae2eca996e6390c6d16

SHA256
21b3ac9b55d1dabedfd9880caaf1dcabee6a914734e125a7a8e72cb1e7cc4f94

SHA512
24d145656ce7f22478e64d5e937c065471a1ad39da4a33f8b9e3dfb52b1a7dcc10d54b3b212e6e82969db4269b730e5b90b7d8fd35919deabc3f09fcc5890a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\E8A0.exe
Filesize
431KB

MD5
5a9fd5240f5f626063abda8b483bd429

SHA1
476d48e02c8a80bd0cdfae683d25fdeeb100b19a

SHA256
df55c7b69820c19f1d89fab1a87d4aca1b2210cb8534e5c895f7e3bc56133a3f

SHA512
cf21686d583274d45410e6a3219a7bbe9a9bb0ad0f05e04ec02dd0815ed5c8f35633d48db5bf5f6b3c1f1c3606218821d9ad1a100a09149b71130a63794e831d

Download Submit
C:\Users\Admin\AppData\Local\Temp\E8A0.exe
Filesize
431KB

MD5
5a9fd5240f5f626063abda8b483bd429

SHA1
476d48e02c8a80bd0cdfae683d25fdeeb100b19a

SHA256
df55c7b69820c19f1d89fab1a87d4aca1b2210cb8534e5c895f7e3bc56133a3f

SHA512
cf21686d583274d45410e6a3219a7bbe9a9bb0ad0f05e04ec02dd0815ed5c8f35633d48db5bf5f6b3c1f1c3606218821d9ad1a100a09149b71130a63794e831d

Download Submit
C:\Users\Admin\AppData\Local\Temp\F459.exe
Filesize
368KB

MD5
f6677a87863747c183d48eb783754fc6

SHA1
3a47f4e4bd9d126d11dfe28543d5c4354a6cfd74

SHA256
4d8e448da30d62d94ebc9d0b3e6a420d37aa0d8d126d098c5388444265c8868d

SHA512
cd25eff6e6931b785def50e25e325b5b68d79b94957c27fba44133426108b7b6cf06608db91630b03d38a9aeda8cdf8b401673737bdf4554ca24fd3a5b73c368

Download Submit
C:\Users\Admin\AppData\Local\Temp\F459.exe
Filesize
368KB

MD5
f6677a87863747c183d48eb783754fc6

SHA1
3a47f4e4bd9d126d11dfe28543d5c4354a6cfd74

SHA256
4d8e448da30d62d94ebc9d0b3e6a420d37aa0d8d126d098c5388444265c8868d

SHA512
cd25eff6e6931b785def50e25e325b5b68d79b94957c27fba44133426108b7b6cf06608db91630b03d38a9aeda8cdf8b401673737bdf4554ca24fd3a5b73c368

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
Filesize
345KB

MD5
074f4690e37f519e136a17d673fb023c

SHA1
6ae97f82fafb429df5c4af4e1f708fa72570cedb

SHA256
b642e29066bc94c378a3de14ba7263ab2190aa4b7c140a667014e388b1fa1da8

SHA512
b3f268cc367d21d5454c906c23a6830677631c0dc1deb6b1ee3d39fba9e9fec7f9b557f0714a75a0bfff1e72416db15bca7d6757f2089024d4ad55d47a3bc9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup1.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Users\Admin\AppData\Local\cache\MoUSO.exe
Filesize
1.3MB

MD5
f972aa6646402a3694cca2d30c63e1f6

SHA1
400ea692dd0cc0ae129fafee31ab18657f5d14f4

SHA256
6513398503a9a37b85b3223a2b020aef82f9c7aedb708d6cc586c0c09b983c8b

SHA512
d5bbf351abddf73ab1a8f9c739ab7f30ce89e0f20539df887f0da314ccb36326a960b93e6ddf5c6f2ea60414ed492b74cf3919c73668a317d7d2381d38641337

Download Submit
C:\Windows\Temp\ib.exe
Filesize
2.5MB

MD5
deff0c816cca7235e9e8e2ef9935d5fd

SHA1
89ab30543bf4041efc909659931835d1128ce075

SHA256
39ac503d5aabf76af1b6782e520b726ac92faf1d158620ef7fed807838ec6d2e

SHA512
4f7a98512740defca44a4f619a184281d848b070e747171a5929dc71b9b9260447cff85f4a3bc8d095ccc5ecf1d50112aec07633ea5b38a54e96f3e02ba5ec92

Download Submit
C:\Windows\Temp\ib.exe
Filesize
2.5MB

MD5
deff0c816cca7235e9e8e2ef9935d5fd

SHA1
89ab30543bf4041efc909659931835d1128ce075

SHA256
39ac503d5aabf76af1b6782e520b726ac92faf1d158620ef7fed807838ec6d2e

SHA512
4f7a98512740defca44a4f619a184281d848b070e747171a5929dc71b9b9260447cff85f4a3bc8d095ccc5ecf1d50112aec07633ea5b38a54e96f3e02ba5ec92

Download Submit
memory/976-1225-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/976-740-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/976-578-0x0000000000000000-mapping.dmp

Download
memory/976-744-0x00000000003C0000-0x00000000003C9000-memory.dmp

Filesize
36KB

Download
memory/1288-1095-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download
memory/1288-547-0x0000000000540000-0x000000000054F000-memory.dmp

Filesize
60KB

Download
memory/1288-544-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download
memory/1288-538-0x0000000000000000-mapping.dmp

Download
memory/1516-693-0x0000000000530000-0x000000000053B000-memory.dmp

Filesize
44KB

Download
memory/1516-1098-0x0000000000540000-0x0000000000547000-memory.dmp

Filesize
28KB

Download
memory/1516-639-0x0000000000540000-0x0000000000547000-memory.dmp

Filesize
28KB

Download
memory/1516-491-0x0000000000000000-mapping.dmp

Download
memory/2244-946-0x0000000000830000-0x0000000000835000-memory.dmp

Filesize
20KB

Download
memory/2244-720-0x0000000000000000-mapping.dmp

Download
memory/2244-993-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/2252-374-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2252-495-0x0000000000550000-0x000000000069A000-memory.dmp

Filesize
1.3MB

Download
memory/2252-369-0x0000000000550000-0x000000000069A000-memory.dmp

Filesize
1.3MB

Download
memory/2252-554-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2252-493-0x0000000000550000-0x000000000069A000-memory.dmp

Filesize
1.3MB

Download
memory/2252-432-0x0000000006620000-0x0000000006B4C000-memory.dmp

Filesize
5.2MB

Download
memory/2252-431-0x0000000006450000-0x0000000006612000-memory.dmp

Filesize
1.8MB

Download
memory/2252-430-0x0000000006290000-0x0000000006322000-memory.dmp

Filesize
584KB

Download
memory/2252-367-0x00000000049D0000-0x00000000049FE000-memory.dmp

Filesize
184KB

Download
memory/2252-371-0x0000000000550000-0x000000000069A000-memory.dmp

Filesize
1.3MB

Download
memory/2252-475-0x0000000008D10000-0x0000000008D60000-memory.dmp

Filesize
320KB

Download
memory/2252-459-0x00000000024A0000-0x0000000002516000-memory.dmp

Filesize
472KB

Download
memory/2252-422-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/2252-364-0x0000000004AD0000-0x0000000004FCE000-memory.dmp

Filesize
5.0MB

Download
memory/2252-353-0x00000000021D0000-0x0000000002200000-memory.dmp

Filesize
192KB

Download
memory/2252-241-0x0000000000000000-mapping.dmp

Download
memory/2252-463-0x0000000007F60000-0x0000000007F7E000-memory.dmp

Filesize
120KB

Download
memory/3308-435-0x0000000000000000-mapping.dmp

Download
memory/3364-891-0x0000000000D90000-0x0000000000DB2000-memory.dmp

Filesize
136KB

Download
memory/3364-897-0x0000000000D60000-0x0000000000D87000-memory.dmp

Filesize
156KB

Download
memory/3364-674-0x0000000000000000-mapping.dmp

Download
memory/3364-1285-0x0000000000D90000-0x0000000000DB2000-memory.dmp

Filesize
136KB

Download
memory/3764-169-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-164-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-154-0x0000000000000000-mapping.dmp

Download
memory/3764-156-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-157-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-185-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-158-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-184-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-183-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-159-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-182-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-160-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-181-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-180-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-161-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-162-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-179-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-178-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-177-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-176-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-175-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-174-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-173-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-172-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-171-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-170-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-168-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-163-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-167-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-166-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/3764-165-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-134-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-132-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-117-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-118-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-119-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-120-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-123-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-124-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-127-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-128-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-129-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-126-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-131-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-116-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-133-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-130-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-125-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-122-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-153-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4124-152-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4124-151-0x0000000000810000-0x0000000000819000-memory.dmp

Filesize
36KB

Download
memory/4124-135-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-121-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-150-0x000000000084D000-0x000000000085E000-memory.dmp

Filesize
68KB

Download
memory/4124-137-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-138-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-149-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-136-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-148-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-139-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-147-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-140-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-141-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-142-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-146-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-143-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-144-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4124-145-0x0000000077480000-0x000000007760E000-memory.dmp

Filesize
1.6MB

Download
memory/4332-625-0x0000000000000000-mapping.dmp

Download
memory/4332-641-0x0000000000140000-0x0000000000146000-memory.dmp

Filesize
24KB

Download
memory/4332-643-0x0000000000130000-0x000000000013C000-memory.dmp

Filesize
48KB

Download
memory/4332-1099-0x0000000000140000-0x0000000000146000-memory.dmp

Filesize
24KB

Download
memory/4544-221-0x0000000000000000-mapping.dmp

Download
memory/5168-1303-0x0000000000B50000-0x0000000000B56000-memory.dmp

Filesize
24KB

Download
memory/5168-766-0x0000000000000000-mapping.dmp

Download
memory/5168-996-0x0000000000B50000-0x0000000000B56000-memory.dmp

Filesize
24KB

Download
memory/5168-999-0x0000000000B40000-0x0000000000B4B000-memory.dmp

Filesize
44KB

Download
memory/5372-813-0x0000000000000000-mapping.dmp

Download
memory/5372-838-0x0000000000BD0000-0x0000000000BD7000-memory.dmp

Filesize
28KB

Download
memory/5372-843-0x0000000000BC0000-0x0000000000BCD000-memory.dmp

Filesize
52KB

Download
memory/5372-1270-0x0000000000BD0000-0x0000000000BD7000-memory.dmp

Filesize
28KB

Download
memory/5584-860-0x0000000000000000-mapping.dmp

Download
memory/5584-1096-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download
memory/5584-1097-0x0000000000F00000-0x0000000000F0B000-memory.dmp

Filesize
44KB

Download
memory/5584-1330-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download
memory/7704-1273-0x00000259D5A00000-0x00000259D5A0C000-memory.dmp

Filesize
48KB

Download
memory/7704-1353-0x00000259D5A00000-0x00000259D5A0C000-memory.dmp

Filesize
48KB

Download
memory/7704-1271-0x00000259D59F0000-0x00000259D59FF000-memory.dmp

Filesize
60KB

Download
memory/7808-1272-0x000001769CE00000-0x000001769CEE3000-memory.dmp

Filesize
908KB

Download
memory/7808-1277-0x000001769CE00000-0x000001769CEE3000-memory.dmp

Filesize
908KB

Download
memory/7808-1352-0x000001769CE00000-0x000001769CEE3000-memory.dmp

Filesize
908KB

Download
memory/7808-1354-0x000001769CE00000-0x000001769CEE3000-memory.dmp

Filesize
908KB

Download
memory/7984-1267-0x0000000000000000-mapping.dmp

Download
memory/8184-1377-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/8184-1286-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/8184-1282-0x0000000140003FEC-mapping.dmp

Download
memory/8700-1350-0x000001B8DEA80000-0x000001B8DEA8F000-memory.dmp

Filesize
60KB

Download
memory/8700-1351-0x000001B8DEAB0000-0x000001B8DEABC000-memory.dmp

Filesize
48KB

Download
memory/8832-1355-0x0000000000000000-mapping.dmp

Download
memory/8884-1365-0x0000000140000000-0x0000000140023000-memory.dmp

Filesize
140KB

Download
memory/8884-1358-0x0000000140003FEC-mapping.dmp

Download
memory/9020-1368-0x0000000000000000-mapping.dmp

Download
memory/9072-1371-0x0000000140003FEC-mapping.dmp

Download
memory/9104-1374-0x0000000000000000-mapping.dmp

Download
memory/9608-1458-0x0000000000000000-mapping.dmp

Download
memory/9780-1483-0x0000000000000000-mapping.dmp

Download
memory/9832-1486-0x0000000140003FEC-mapping.dmp

Download
memory/9860-1489-0x0000000000000000-mapping.dmp

Download
memory/10360-1568-0x0000000000000000-mapping.dmp

Download
memory/10720-1593-0x0000000000000000-mapping.dmp

Download
memory/10844-1619-0x0000000000000000-mapping.dmp

Download
memory/10896-1622-0x0000000140003FEC-mapping.dmp

Download
memory/11268-1673-0x0000000000000000-mapping.dmp

Download
memory/11700-1732-0x0000000000000000-mapping.dmp

Download
memory/11752-1740-0x0000000000000000-mapping.dmp

Download
memory/11848-1754-0x0000000140003FEC-mapping.dmp

Download
memory/12116-1784-0x0000000000000000-mapping.dmp

Download
memory/12240-1810-0x0000000000000000-mapping.dmp

Download
memory/12396-1814-0x0000000140003FEC-mapping.dmp

Download
memory/12520-1831-0x0000000000000000-mapping.dmp

Download
memory/12644-1857-0x0000000000000000-mapping.dmp

Download
memory/12696-1860-0x0000000140003FEC-mapping.dmp

Download
memory/12992-1880-0x0000000000000000-mapping.dmp

Download
memory/13156-1906-0x0000000000000000-mapping.dmp

Download
memory/13208-1909-0x0000000140003FEC-mapping.dmp

Download
memory/102828-275-0x0000000000422112-mapping.dmp

Download
memory/102828-378-0x0000000008D60000-0x0000000008D9E000-memory.dmp

Filesize
248KB

Download
memory/102828-366-0x0000000008DC0000-0x0000000008ECA000-memory.dmp

Filesize
1.0MB

Download
memory/102828-321-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/102828-381-0x0000000008ED0000-0x0000000008F1B000-memory.dmp

Filesize
300KB

Download
memory/102828-372-0x0000000008D00000-0x0000000008D12000-memory.dmp

Filesize
72KB

Download
memory/102828-363-0x0000000009270000-0x0000000009876000-memory.dmp

Filesize
6.0MB

Download
memory/102992-307-0x0000000000000000-mapping.dmp

Download