e7dd3449cb2fd81c06e0f5c19e20b280c80fc4533356f3bf67fdfcb6ce238056

Analysis

max time kernel
103s
max time network
153s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
30-05-2023 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyHunter-5.13-6-5285-Installer.exe
Size

6.6MB
MD5

3ce9158024e74733de9ab2232fb73dcb
SHA1

5fc8ed33206ab5b93f736114ba99bf47f81bfef6
SHA256

e7dd3449cb2fd81c06e0f5c19e20b280c80fc4533356f3bf67fdfcb6ce238056
SHA512

ac2e9d45a992513d8f4efee73f5a7166071b837302fc91888122d6a211b0437de75776d509b308809751b7c9fad69ebca5f8c6835d66b6fcb467f4cd434f06bb
SSDEEP

98304:qzCgxMDk3jEO+F7qxBO7j/11ajr5pJ+9PbES9qCJV03oJT2wIZx3oIODbhHMxvTk:qHMOjEO++CqFpJ+9PbxXV0YJzD9HMxvY

Score

8^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Drops file in Drivers directory 1 IoCs

Processes:

ShKernel.exe

description ioc process

File created C:\Windows\system32\Drivers\EnigmaFileMonDriver.sys ShKernel.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\EnigmaFileMonDriver.sys	ShKernel.exe

Patched UPX-packed file 4 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

Processes:

resource	yara_rule
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	patched_upx
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	patched_upx
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	patched_upx
C:\Program Files\EnigmaSoft\SpyHunter\Temp\ShKernel.exe-5.15.9.313-x64.dmp	patched_upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

ShKernel.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ShKernel.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ShKernel.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SpyHunter-5.13-6-5285-Installer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	SpyHunter-5.13-6-5285-Installer.exe

Drops file in System32 directory 2 IoCs

Processes:

ShKernel.exe

description	ioc	process
File opened for modification	C:\Windows\system32\sh5native.exe	ShKernel.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	ShKernel.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 56 IoCs

Processes:

SpyHunter-5.13-6-5285-Installer.exeShKernel.exeShKernel.exeShMonitor.exeSpyHunter5.exe

description	ioc	process
File created	C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Defs\Rh\full.dat	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Slovene.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Logs\20230530_121902.krn.log	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\purl.dat	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Bulgarian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Hungarian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Japanese.lng	SpyHunter-5.13-6-5285-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Temp\2023052703_inc.json.ecf	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Dutch.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Logs\20230530_121909.krn.log	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Brazil).lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Portugal).lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Native.exe	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\license.txt	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Finnish.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Norwegian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Temp\ShKernel.exe-5.15.9.313-x64.dmp	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Serbian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Turkish.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Ukrainian.lng	SpyHunter-5.13-6-5285-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Data\ScanHistory.dat	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Swedish.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\data\acpwl.dat	SpyHunter-5.13-6-5285-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Temp\2023052903_inc.json.ecf	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Romanian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Russian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Logs\ShMonitor.log	ShMonitor.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Temp\2023052703_inc.json.ecf	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Indonesian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Temp\2023052802_inc.json.ecf	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Defs\full.def	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\German.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Lithuanian.lng	SpyHunter-5.13-6-5285-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Temp\2023052802_inc.json.ecf	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Albanian.lng	SpyHunter-5.13-6-5285-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Data\ScanHistory.dat	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Korean.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Polish.lng	SpyHunter-5.13-6-5285-Installer.exe
File opened for modification	C:\Program Files\EnigmaSoft\SpyHunter\Data\ScanHistory.dat-journal	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Logs\20230530_121912.sh5.log	SpyHunter5.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Greek.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Italian.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\data\acpdata.dat	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Danish.lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Temp\2023052903_inc.json.ecf	ShKernel.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lng	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Program Files\EnigmaSoft\SpyHunter\Languages\Spanish.lng	SpyHunter-5.13-6-5285-Installer.exe

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdgeCP.exeSpyHunter-5.13-6-5285-Installer.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Tasks\EsgInstallerTask83.job	SpyHunter-5.13-6-5285-Installer.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Executes dropped EXE 5 IoCs

Processes:

ShKernel.exeShMonitor.exeShKernel.exeSpyHunter5.exeSpyHunter5.exe

pid process

932 ShKernel.exe
2700 ShMonitor.exe
204 ShKernel.exe
2172 SpyHunter5.exe
3828 SpyHunter5.exe
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3976 sc.exe
420 sc.exe
2052 sc.exe
3404 sc.exe
4124 sc.exe
608 sc.exe
4676 sc.exe
3104 sc.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

428 regsvr32.exe

pid	process
932	ShKernel.exe
2700	ShMonitor.exe
204	ShKernel.exe
2172	SpyHunter5.exe
3828	SpyHunter5.exe

pid	process
3976	sc.exe
420	sc.exe
2052	sc.exe
3404	sc.exe
4124	sc.exe
608	sc.exe
4676	sc.exe
3104	sc.exe

pid	process
428	regsvr32.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32\ = "C:\\Program Files\\EnigmaSoft\\SpyHunter\\ShShellExt.dll"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ShKernel.exeSpyHunter5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ShKernel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ShKernel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ShKernel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ShKernel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SpyHunter5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SpyHunter5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SpyHunter5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SpyHunter5.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

ShKernel.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ShKernel.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ShKernel.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	ShKernel.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32\ = "C:\\Program Files\\EnigmaSoft\\SpyHunter\\ShShellExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = c7407ea65a45d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = c7407ea65a45d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 624007ebf092d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D71FC887-4726-44C5-AAE3-A27DE8B8322F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{026941B7-ABD1-4F16-ADB7-E811B8BAC354}\1.0	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

SpyHunter-5.13-6-5285-Installer.exeShKernel.exeShKernel.exe

pid	process
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
3240	SpyHunter-5.13-6-5285-Installer.exe
932	ShKernel.exe
932	ShKernel.exe
204	ShKernel.exe
204	ShKernel.exe
204	ShKernel.exe
204	ShKernel.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

ShKernel.exe

pid process

204 ShKernel.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

5028 MicrosoftEdgeCP.exe
5028 MicrosoftEdgeCP.exe

pid	process
204	ShKernel.exe

pid	process
5028	MicrosoftEdgeCP.exe
5028	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

SpyHunter-5.13-6-5285-Installer.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeShKernel.exe

description	pid	process
Token: SeShutdownPrivilege	3240	SpyHunter-5.13-6-5285-Installer.exe
Token: SeBackupPrivilege	3240	SpyHunter-5.13-6-5285-Installer.exe
Token: SeRestorePrivilege	3240	SpyHunter-5.13-6-5285-Installer.exe
Token: SeDebugPrivilege	3240	SpyHunter-5.13-6-5285-Installer.exe
Token: SeTakeOwnershipPrivilege	3240	SpyHunter-5.13-6-5285-Installer.exe
Token: SeDebugPrivilege	4888	MicrosoftEdge.exe
Token: SeDebugPrivilege	4888	MicrosoftEdge.exe
Token: SeDebugPrivilege	4888	MicrosoftEdge.exe
Token: SeDebugPrivilege	4888	MicrosoftEdge.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5064	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4888	MicrosoftEdge.exe
Token: SeBackupPrivilege	204	ShKernel.exe
Token: SeRestorePrivilege	204	ShKernel.exe
Token: SeSecurityPrivilege	204	ShKernel.exe
Token: SeTakeOwnershipPrivilege	204	ShKernel.exe
Token: SeLoadDriverPrivilege	204	ShKernel.exe
Token: SeBackupPrivilege	204	ShKernel.exe
Token: SeBackupPrivilege	204	ShKernel.exe
Token: SeSecurityPrivilege	204	ShKernel.exe
Token: SeSecurityPrivilege	204	ShKernel.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

SpyHunter5.exe

pid process

2172 SpyHunter5.exe
2172 SpyHunter5.exe
2172 SpyHunter5.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

SpyHunter5.exe

pid process

2172 SpyHunter5.exe
2172 SpyHunter5.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

4888 MicrosoftEdge.exe
5028 MicrosoftEdgeCP.exe
5028 MicrosoftEdgeCP.exe

pid	process
2172	SpyHunter5.exe
2172	SpyHunter5.exe
2172	SpyHunter5.exe

pid	process
2172	SpyHunter5.exe
2172	SpyHunter5.exe

pid	process
4888	MicrosoftEdge.exe
5028	MicrosoftEdgeCP.exe
5028	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

SpyHunter-5.13-6-5285-Installer.exeMicrosoftEdgeCP.exeShKernel.exe

description	pid	process	target process
PID 3240 wrote to memory of 3104	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 3104	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 3976	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 3976	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 420	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 420	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 2052	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 2052	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 3404	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 3404	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 4124	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 4124	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 428	3240	SpyHunter-5.13-6-5285-Installer.exe	regsvr32.exe
PID 3240 wrote to memory of 428	3240	SpyHunter-5.13-6-5285-Installer.exe	regsvr32.exe
PID 3240 wrote to memory of 608	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 608	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 4676	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 3240 wrote to memory of 4676	3240	SpyHunter-5.13-6-5285-Installer.exe	sc.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 5028 wrote to memory of 5064	5028	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 204 wrote to memory of 2172	204	ShKernel.exe	SpyHunter5.exe
PID 204 wrote to memory of 2172	204	ShKernel.exe	SpyHunter5.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

ShKernel.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ShKernel.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ShKernel.exe

C:\Users\Admin\AppData\Local\Temp\SpyHunter-5.13-6-5285-Installer.exe
"C:\Users\Admin\AppData\Local\Temp\SpyHunter-5.13-6-5285-Installer.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe create EsgShKernel start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe\"" DisplayName= "SpyHunter 5 Kernel"
2⤵
- Launches sc.exe
PID:3104

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe description EsgShKernel "SpyHunter 5 Kernel"
2⤵
- Launches sc.exe
PID:3976

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe create ShMonitor start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe\"" DisplayName= "SpyHunter 5 Kernel Monitor"
2⤵
- Launches sc.exe
PID:420

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe description ShMonitor "SpyHunter 5 Kernel Monitor"
2⤵
- Launches sc.exe
PID:2052

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe config ShMonitor start= auto
2⤵
- Launches sc.exe
PID:3404

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe config EsgShKernel start= auto
2⤵
- Launches sc.exe
PID:4124

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /s "C:\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll"
2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:428

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe start EsgShKernel -tt_on
2⤵
- Launches sc.exe
PID:608

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe start ShMonitor
2⤵
- Launches sc.exe
PID:4676

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:932

C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe
"C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2700

C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe"
1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:204

C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
"C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe" /hide
2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2172

C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
"C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe"
1⤵
- Executes dropped EXE
PID:3828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\EnigmaSoft\SpyHunter\Data\ScanHistory.dat
Filesize
8KB

MD5
f0d12083b3230a11fa8e676b602c689d

SHA1
86e11395c07353806a1280b08f00697c3125e83f

SHA256
d2d92b055993440feb75f162f65691f19cd8881864d4bc92fcea176b86c6add5

SHA512
c713416cc02a8eae72e83d1c3f298f09d1362cc396713a4fa93cc1353342556a3bed02440a5d5c017ca3ae6bff67e2f5bdc90a59d53e1c43de39d46306b8cbc9

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Defs\2023052703_inc.json.ecf
Filesize
21KB

MD5
b17274103fa634380d5ad4606cefcfc8

SHA1
2369b422799b3371c39aff8ab94c0f8930af0670

SHA256
5c5236a0a7d55298347e9b3486de6d866cba75168a7ba2728cb2b64022e78cec

SHA512
c26837577bfe8bc07a080479b9422259b02c364fe27f13e4c211b7a67fbee128db2d43d4b2cb78e9f224031322f58818599212a23301e559c0129409e961dbb4

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Defs\2023052802_inc.json.ecf
Filesize
14KB

MD5
d723f8f2f470c5176cef9d0af59e8dfa

SHA1
8745d6c3b03a37f16179a7fd96d0784eb03d8091

SHA256
e2eb8fd6a1fcc0ad3356ca1a312113a7a5f9b778a546ab74c2e2bca35c0f8d1b

SHA512
de2eef09d53a3281ffeac87c4c608931c49eb001ccbcd7417925af68a7d3cedcd67a0560a1d3e4001d9ca36b68cb4617c33c2b47d0884822a4530e0ee3c89846

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Defs\2023052903_inc.json.ecf
Filesize
37KB

MD5
d0488090b0e5ea95c2765a0b41f4a1eb

SHA1
3ab86487a87dfa5274d31ad6f929ff8ca4b67c12

SHA256
6d7913a7fad78e7c66e7dfb74fa6c7c5ec239790b941c8355619ab4bcc9c4176

SHA512
ec8470e3efc4678fc424182f61172877c71ada5f1a5c1d6d1d07b5734362748e7ca1b4c4154aa0e408fa46802bc9f49a402ed2210d9dfebae2e5cf46b3816ff1

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Defs\full.def
Filesize
53.9MB

MD5
58bb8a0609e0bd9193453fb8fed765d9

SHA1
74135caec184ea8eb947bf9794e82c09cc3ce717

SHA256
0a27d29e459226f91c2993a5211628f5c746f24792f95b709ed0e8f164b2825a

SHA512
454ba7c995f16fe31d7b1aef83d3d346cd6a645365bb89629014a2e7f4d9d3686879ceeb59a1441409987bb86c43d698ba680009ba7e07247a1d3b7e191decc6

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Defs\rh\Full.dat
Filesize
60KB

MD5
a52adf86b1feaa15e899c1fe3d6a68a3

SHA1
210b997dba1b4719070f9b54bcdab517e1e8b84f

SHA256
ad87ab7a47d55a45c946efd9caa4658a0c2d622389cccbe91dea450aebc07674

SHA512
0c3b23ad43f973869bfefea5021481b0754f944ce2fc56514ebb8ff60e20c431f18acf051ba833e536536e3940b0717178a08794285d86b7e50b1313967d6029

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Albanian.lng
Filesize
51KB

MD5
90c91c63366c84205db147f653fe990e

SHA1
892fc8a86cb901ddaefc9cda270772793bf71f10

SHA256
75624a118da254f8cda29a2721c5d059b366b55e1e856c305853ca5fb673611c

SHA512
b84aa4108edeb40b9438e48e6b60b97cc658952d2341e2f3f19422dc7beba8c8697c8c189d31030d39e6ea81426f18ec1e6807c426ad265d74719e2d34c2a577

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Bulgarian.lng
Filesize
57KB

MD5
8c6786c0eb601c927726a82b00abe71b

SHA1
8a8176790e048dc7f160e8fa89dc9a8cacdd957f

SHA256
619dbd90661af33653af3f3253c76d594ffd24060bbff2d1a0e51461f72477b8

SHA512
4fb9125ed007b260104dec96460e52aff722e97d381bc6b62c9de9135d625f7cc1f8c3a5f7cabf930ea03bce60b7237463d227d21083e4215abf035f04b02235

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Simplified).lng
Filesize
45KB

MD5
6303be5f5fb7e47aab74a59f164bc47b

SHA1
ffc11ae266f87e5ec96c24fef30e900c8ac0c9c8

SHA256
3007e3430673593c393174d8dd7dcf6cb4d2f4ac31fa40dcbca1d6daf8e167cc

SHA512
bab0ac40bc70a52e837e399865b8682fe1c033e1967988a3b8dd6727a38d6f59369daf68b4f28437bb337abb0a8d2fa3dda63cc645221b56afcaac9d2a93a32c

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Chinese (Traditional).lng
Filesize
45KB

MD5
8c2b1108892b6a901557e69b29bd1275

SHA1
1167f17fe98448d482080c7a3c7658a8d90d5a9d

SHA256
5f6c0a5c27e15c6f8c9bceb442719165f44c34ada0d83f972789efaa830b7d48

SHA512
3f1188a08785f55a48eb97a17b21378a2a0db32ddada73821d048cb4da64d4c6a46849deabe2c4dd411035590c6b9bc6be11c267710a34f3fb0afcceef2273b0

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Croatian.lng
Filesize
49KB

MD5
4efd67bfcbbad1719019b81345b9efaa

SHA1
5b7e9bb695db6b1ed4745baeaf1510c696cbc3d0

SHA256
3585c57b6738b83d30c3836ad605c1d43add6267cff37c1f7c680fbfdae79978

SHA512
3e3afafaf846a8c6637fd0a451a6bd1cb52e0e8c0b791c6cb8ba838c56ae5e3164ee313cdac0aa2524962bfe9b60c82a17cb4f5be2c445f6e86c44a8c8023a8b

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Czech.lng
Filesize
51KB

MD5
26b44a8271eeff5dd93ac3a2e3cdd5c1

SHA1
78bb59215629882cabbe33d316f358bbae14f10b

SHA256
e98fba37a14e85e91ebc434ab038635b7315d95cddd24f750b43afe67924d99d

SHA512
4e17c07b8973a50fde83c1c5f4f553b35eacd842928a43bc079db459a6e53e0dd53ed5d164bc77ade40511c9fcf390087a25280213d4c9b3c4c96390e0a97428

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Danish.lng
Filesize
47KB

MD5
b40466ac91b2225ad8efbd4ed13dc0ad

SHA1
0cf517ca273d3d482b48fed4658e8329f2f4c251

SHA256
21c3b60a058b3b4b8d08b05a50c99ec7eaf6cb9b67ed0f87082484ad35684d96

SHA512
1ba36e8f5ec5624f55d9505543391bf527cf8ae9510191a52d364d85517b564e59486f798b111c4977d473bc440516bc171588383c886e68a87d7ec38badcfce

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Dutch.lng
Filesize
48KB

MD5
aaefb39af8a0d8d1cb3f6aa2bca4d8bb

SHA1
ab74cb66c2beb08414ebc65bef7cbda14aba31a8

SHA256
29f07174db85bfbc19199050f0718de18f145ed8639de0db9f09d0da4f715493

SHA512
f92e8ef060903295ad4ad1dbcf117e1cee25cb9c92dfae03f642c9ebd65d63d3c4a6bf274e8ebb24572e7a018e59238977a6f61acbb00a5ea1745e9803da33cc

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\English.lng
Filesize
43KB

MD5
a518975338d6353d40ff7966f9f58ede

SHA1
7fbf81bc867aadcc86aab38ae41375113146654a

SHA256
1bfdbf5e6349531bd5ef573a7f18f528a974dd554148e465182d37bc6e1a713c

SHA512
98ee9bccba39d5cae25fea8f68cfe009cabd6f694197565ba4ed32a58da940ee2d1011df36710e3e62235dee5ccfe305af42c480e2f270526747418115f3230a

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Finnish.lng
Filesize
49KB

MD5
47e3cbffaee3bf2534814de8fb5175ff

SHA1
46ca75da34a88c2bf9c40674133a06abedeb5135

SHA256
6c8322fbde9eb5e9caff970f934a4de08f38ef7b9cb1f835583144c01b65fa6e

SHA512
7b880963eed7abc084b35b9513953cf4f638cd45e298ada33ab405889b18c7b6e78811d2a202cd1d660e0eacf112e143c8019b4df738fe269a34842273edc634

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\French.lng
Filesize
49KB

MD5
6cf18c301e54e22935ecb7693f275a53

SHA1
eba53f207a5fc16610cb080cc1d1403034925a5c

SHA256
8b6fbed1cda947e03cfb8f0de53a1a10f36f21f291edf1b1c065a4f32d5a3615

SHA512
dd3e7ad0f749b7de4fb026b7dc3a6acbd0833893dbb7d8fa05881dee01b68df41c2432609af927c2bf8a0a636c725f25a2ff6bcfc1e94df3804fe2a875f6df8b

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\German.lng
Filesize
50KB

MD5
50df8720319b1836b5450a4b7d1bcf81

SHA1
1a9560a99a00fd5b3c77085d29f3f1812933a27b

SHA256
cc953c4cd224c0c1697347d6ad6937501f5de976c838b09250cc1e0045e3b1fb

SHA512
3d6df1f4a63e114a4e8f7cc39a0329ce9c029168ec09dc0e0119a8c9cb69ff25e9ac3a4f7a3d1dbfccc8819deac6856ec4dbe39f18d838f4fb9dad7db4ae76cc

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Greek.lng
Filesize
60KB

MD5
92ce5a29b736b828d5c722fca9ddb1eb

SHA1
dd77ec892967d389222efec1d4c6654ed44b3896

SHA256
e6fb15077bac86fbcff2651681fedfc85aad4d996cc6c70c73101402a6ff50a8

SHA512
b6376c084ab45083c7f226b6526520561fea7530a332610c2d2e3c29db29a298f8b8b9faef68c2d2dcbb7c04c1d9d9847b46ede451bbd5fb606bb796a7c98447

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Hungarian.lng
Filesize
52KB

MD5
3a9edacd16014ba67c969f19df844dad

SHA1
9b87f2d7cd77b019d859c1d2bc886839c27d1dce

SHA256
8be226d27806f7485369a1a9f12354204003b55c193f5838596300a696f8d3e4

SHA512
70affaa3e9450055c9ced66a4ec7c67e1c8140a42b9e42e5c8e3ade6f0bb2e174608a26841abd0e9bde1c243717fd81f11601415de05d3a45cdc523d6b222c9b

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Indonesian.lng
Filesize
45KB

MD5
7b62e789c121f9269a1bc92899c07a75

SHA1
3d0ef8536c2662b9884cd644034c9db89fe1d2cb

SHA256
be899594223a099c0dce89b911c1a40b8a1b0bf8df3b1647836fb3da3fe0e830

SHA512
a14749ff91b608045c1378ae5e8932b0ba5ed7da59f9cf17ca1679b26cfc6405e853a5e43d32ad093eb81e7da5f6fe0fb0520997cdb13a57cd619858e59966ef

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Italian.lng
Filesize
48KB

MD5
01a01c7ba8bd9866073ca5d179c66166

SHA1
f7db554b50b8ef3fc9b2808309f8df9f1d1c0dbc

SHA256
ed26a07f9d412ec35fe77608e3696b4435855f666add56e6ea798f4300070f34

SHA512
70c937f3d39f21bd2e5bafaa8e5a5b7effbf0f159826c45cf745f99c09e9308f60f7de1553272d35c0191bcb181cbd45a41c99923d1d0f5e5509b07da5793fe7

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Japanese.lng
Filesize
51KB

MD5
0160e54ce0eb548182ee6aed440d4164

SHA1
e1880a9474e83aa71dfada62e540f9dbdaf45fcf

SHA256
acaae001e5b773df479ecf60150d08f962dd88c86182720a4edb9ffb13d4385a

SHA512
509d2ba7d7387ab5d97edfe6f4c40ae8022dbd65e69497aea6f73e29a7512a5dd1e50c935e0ca38b18f206ce7cb6e06576ab6da3a96c0196c54d1d498b8735c4

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Korean.lng
Filesize
47KB

MD5
be030a3659558c19a4a9ef9aa541b915

SHA1
04d12e1244c690e76a93750848543d987453f8df

SHA256
9ed074bec18cdfcd3dd68e0ed78bccdeb81f9ad57749213a0fe7f1ce245d4d5a

SHA512
4d7ae82f60c26014d24b9dbab64885fd9c26ace1fda58b92bf4cb605312b959a00b6f67b6095e707ec5926aaf11610835523f9b34ff6d985cdf8ff539b7a18c8

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Lithuanian.lng
Filesize
50KB

MD5
9d2390bd1cf46ce6180df52a83fa1998

SHA1
e015c43088e4ee88eb2a041cc58b5bc07567a3d7

SHA256
5c7bc6e484645b241db387a50e8364726a7b133bf89d4b086e7612f158cd4950

SHA512
89751a591609db4177626586138a73ec8a018cae2ee73533b94e192a1ec46460e7eaade6f158deb052644891a70dd90e9c236f9b6724ecb9571491e74452c402

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Norwegian.lng
Filesize
46KB

MD5
873d9536658d18f37dc6136255708ba0

SHA1
d464c703463d181ac6bdb9d2de4e2674128f0912

SHA256
2c0b81ae46e174ae566ff8ef766152fcd9cfd0ce9a8d91bc7a562232489cb9e1

SHA512
d7a87253b554c3c38a367a725b0e503532ffd01b38e498bfb07f33a4f5738752a519d26dfd5c32c40bd97e4f240a2f964b81a3d1ef822a6a555d242dee6b67eb

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Polish.lng
Filesize
51KB

MD5
1a59bae06a02479306fe2294842d8ae4

SHA1
2037071693ad4998ba33204e9ed960d294d9e9d9

SHA256
0e8dd387db9d1350f6b1ffad5b8a9719ea2954b12d107070fa356b2550e1c571

SHA512
6e19e1cc368534697f254dbdea8ebb29cccdf0015a454dee648316a5a797594a1f46c08abf7f0b26bc31d0db206b9d91dc64be70655932943fcd56a42ab220aa

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Brazil).lng
Filesize
48KB

MD5
a472b075c3b8b08ed76a42cdaf0c319f

SHA1
5880fa64a917de1736171e71b60b241cce4f059b

SHA256
d4512b07d845c89b1a253c8559d85ccc2cfe156c86110b74d3d22f9325981838

SHA512
fbcf961d3a1536ce747b3f99b0def88d6d16eff75b6898a67290c85c96b6ad7839a1ec384f5d570efefde4910b4011d75f9f8b8a4f092cd25c36078372f6fe3e

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Portuguese (Portugal).lng
Filesize
48KB

MD5
e2691bf96e82ebc952ebb146bc70d3fb

SHA1
fa5e3557aa56bdfe550de86b69b1e636bc3a7271

SHA256
ebf980d438532975da5970dc5934a1ffcf447f905e5c3fd9137ca5561b91ba21

SHA512
9c6fe3f24fb3ad8559489aea766e9d47d7c43625d348535736a1f8ff0953b0a3b28cd3fcd177bd9c391cf89e883fdd82901020636319f1b77d1e1a743e6ab3dc

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Romanian.lng
Filesize
50KB

MD5
1076a42570a7e06b1e02a7173e7b4465

SHA1
966a8e8fd552778a66b84c4b70ecb6dc559cdcbd

SHA256
13b3574ad7746c30e9777d884deec1f0c75551cb16245105daede7f525f4deb7

SHA512
2b81a3bb0f86b30f5a133ee22b36f56696f9e2611f090891fc3fe2863bbc95d078e8435d86cc177f3683a7c6394a7f4720a263d14dbd1aaebc80118ce90c0523

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Russian.lng
Filesize
57KB

MD5
43a5f6e364555a5daecee67bfd43b9e5

SHA1
d1219bbc6925d570fba7195497b478ac9c6002cd

SHA256
2febb47993196fb3f0835b0800755602e8011314f4fdd7bccb307accc194ab58

SHA512
c2d207be8dbac98f32a45e17bb6cde0c99296220eb033a6d72f97344bbc9733b422d96fd55cb8e8889d4a6c7fe644dd0191bbb4674d7c3c78adce3db5dbda77e

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Serbian.lng
Filesize
51KB

MD5
96b9804891338c27d8acfe39abf309fe

SHA1
b14bf327e78f496e8023a0cef5d4a6855794a885

SHA256
cf070d67a82212cce53c98bddfc3fc129a3a9e860fa78df81823bda8f1664bb5

SHA512
d8d0518fd5c3d98d1d2465edf0b44a826a274a7974a0336e78026aab938db1ab1f3d7318b1700e7d16f2841f3d10086e706b270850c83df49ce2d3bde6a34b8f

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Slovene.lng
Filesize
49KB

MD5
a2fcd4d47727c583d1f760a67774272b

SHA1
0471e603529130e3b1b8a0828924e8affd245b4a

SHA256
147dad85e6a3de90350df750765a71828bcaccf753ed2754108c2df5b5c4ec94

SHA512
87cdbd574328a6cfff8977d21f37de8e41608d19430dabda552bcbb3058fc56ab938a4e3fe672511aeb58a79f7a1dab08ac54a6ddcf5505575b316c28f79e600

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Spanish.lng
Filesize
48KB

MD5
cccf9aa3c8f7e0fa86d66f2a39b4db6a

SHA1
62b0b308c74ee787400508ac2c96fd6bee5a9ef4

SHA256
917de266d1217716c8d03ea7ccd4b8602204cef18fa2214be71341a2190ef2b1

SHA512
3841b0768c672fb9a7045573395e79292f9acbfdd308cf86c0211500231913cffb6668554fd522fce622b25b3a17d994f75531238997215d2a29c20e2865b20b

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Swedish.lng
Filesize
47KB

MD5
71a71f521ab85d964b463d59a9872a1e

SHA1
70d46076a360bcedff90cc7c4d9c6eebd05af0f4

SHA256
06573d5d57daea00c3e55471b90d484e4a98957bba7d45020f038213bc443213

SHA512
df37ca76e0450afdfa03737ae5394fa7d0052193fb7ad9ad1eed3224e3039bb1931cbdeb0c9d1995c4baf64f8cab1e293bf9f6773b1aaaea61e17c409ad7390e

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Turkish.lng
Filesize
49KB

MD5
c1dc60f5fe8f6267f21663a746cede36

SHA1
f0492758631e6ffcf4a4b05ae439171a5872aac1

SHA256
ad58066bed5da405695d16e8338174a7a5c0e54a620c00546e622a32689b2d7f

SHA512
bd73f46989fb207c76d4d63cf7f402540d10d7919ba545a9911207545e2349de7a46f8459cd2c86d4ad196c3952f26bf70ddeb5411910a5818eedc4608dd998b

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Languages\Ukrainian.lng
Filesize
57KB

MD5
eced67a6f493263550449fcb3c82468b

SHA1
976040e03060b2abfc2cdac872bdf5f01662e00f

SHA256
646f0eccba1e4a0f9c3c4215575c893a477012c1875287bd099aa1d614ab7fcb

SHA512
b740ed69fbefec733bbc2930ddde968cf9dc626c1de29c4dae74173fd05cd4d749f370e4e208b8162905e54e66a1308834fe043b313487c030952dafa02fac38

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Logs\20230530_121902.krn.log
Filesize
8KB

MD5
a005a5f213d0520fa02860c3e413bbdd

SHA1
a53e4f4b61ae2c6a2e74aa477cdd2e4d25657571

SHA256
bdc52fd2969e884b2180eb151e173115760abee1cf6eb44cc90830227b7b07b7

SHA512
98d914174bb292cca2fa464c255b29dbd372fc0f2380dbae818d198ac1a52802bfc4e49817b0f72232b4db56af888cfb9954748dc44a9bb4189301fa2c0374a7

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Logs\ShMonitor.log
Filesize
2KB

MD5
69c53494f09b810cfb359389ca8d5566

SHA1
d896eca3cdb9422c5472d18794a3619d7017083d

SHA256
bd89c46f4ab3408f55e63c0ea0423b13472b4f1c7a86f0f9179953fa0d4aa060

SHA512
ad034ed5d334fe9058ccc28ae6035bc150f67aa924bc74ce0503862e49f57ae1c79f59e6e65c69057e86edcaa5bfae68e410aaa5f01f98623b5ffaa0805eeccb

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
Filesize
16.6MB

MD5
89e6cb6c6578ee267f27df65bedce073

SHA1
748ca35a19db4f54f077c40e545ac985d74cceae

SHA256
20aa5a3498d490e522fcaae916c44a189686f4671bf03067454e4b6b34310c72

SHA512
e71c71d9d5452fe18e1bbb957e113f4c2035aee57d4b177c8ed355d80b0d58562680fe914552ddada26e92fb0651f9e3aae9322c8b4148e6491119928953ae46

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
Filesize
16.6MB

MD5
89e6cb6c6578ee267f27df65bedce073

SHA1
748ca35a19db4f54f077c40e545ac985d74cceae

SHA256
20aa5a3498d490e522fcaae916c44a189686f4671bf03067454e4b6b34310c72

SHA512
e71c71d9d5452fe18e1bbb957e113f4c2035aee57d4b177c8ed355d80b0d58562680fe914552ddada26e92fb0651f9e3aae9322c8b4148e6491119928953ae46

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
Filesize
16.6MB

MD5
89e6cb6c6578ee267f27df65bedce073

SHA1
748ca35a19db4f54f077c40e545ac985d74cceae

SHA256
20aa5a3498d490e522fcaae916c44a189686f4671bf03067454e4b6b34310c72

SHA512
e71c71d9d5452fe18e1bbb957e113f4c2035aee57d4b177c8ed355d80b0d58562680fe914552ddada26e92fb0651f9e3aae9322c8b4148e6491119928953ae46

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe
Filesize
2.4MB

MD5
906bd9b4f45431908ee5ca6821a254f0

SHA1
dc2d0684f65e6041d5860ebb8a17630b76953495

SHA256
0f400e4cd8c969a07c5a250bbd29d8dedaea60044ede2e7427ddd0ef2bbdcc3d

SHA512
4c10d0a89f1f947a3249ac62022faab79881f9657aca6bc2c89ca8581af3e4a85750d2a2702edb778e196adffa4eac4b4511052b047c78dd02efe7ca1e062c48

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe
Filesize
2.4MB

MD5
906bd9b4f45431908ee5ca6821a254f0

SHA1
dc2d0684f65e6041d5860ebb8a17630b76953495

SHA256
0f400e4cd8c969a07c5a250bbd29d8dedaea60044ede2e7427ddd0ef2bbdcc3d

SHA512
4c10d0a89f1f947a3249ac62022faab79881f9657aca6bc2c89ca8581af3e4a85750d2a2702edb778e196adffa4eac4b4511052b047c78dd02efe7ca1e062c48

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll
Filesize
2.7MB

MD5
d247abcd02547a0843f6cbd354e7d77c

SHA1
bbb0e7255c7a4239fc31f0c631a7d67eef902d19

SHA256
baff569bd191de8798865e5acefb1be5356dad26ab9b6ac125f0f47cdff206d7

SHA512
7b6ed443e96e51ceb204a1563faf0345d415d7930a66cda2bf17db17c014f3f916dab09b9024233bcda19f8b376b7098c6e11a978ef4720b23227f8177d21c89

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
Filesize
18.5MB

MD5
f754c1a4e99eedc585febaf826419ab1

SHA1
82b56dc05de59a16f31263b40b7d3593728c1bc1

SHA256
521389c075689b125a4f29ca1782a4d680ea24dfa3fbc3b1f76003a83257dad3

SHA512
f171430c37ddc9903e631977b4a30bfec2a43667cb7f99358c841a6e5b84f50d16b2ec54a1eba559fd06c2cec7e96105bf4d8518cc52fe03300ca5eb2dcf40e7

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
Filesize
18.5MB

MD5
f754c1a4e99eedc585febaf826419ab1

SHA1
82b56dc05de59a16f31263b40b7d3593728c1bc1

SHA256
521389c075689b125a4f29ca1782a4d680ea24dfa3fbc3b1f76003a83257dad3

SHA512
f171430c37ddc9903e631977b4a30bfec2a43667cb7f99358c841a6e5b84f50d16b2ec54a1eba559fd06c2cec7e96105bf4d8518cc52fe03300ca5eb2dcf40e7

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
Filesize
18.5MB

MD5
f754c1a4e99eedc585febaf826419ab1

SHA1
82b56dc05de59a16f31263b40b7d3593728c1bc1

SHA256
521389c075689b125a4f29ca1782a4d680ea24dfa3fbc3b1f76003a83257dad3

SHA512
f171430c37ddc9903e631977b4a30bfec2a43667cb7f99358c841a6e5b84f50d16b2ec54a1eba559fd06c2cec7e96105bf4d8518cc52fe03300ca5eb2dcf40e7

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
Filesize
18.5MB

MD5
f754c1a4e99eedc585febaf826419ab1

SHA1
82b56dc05de59a16f31263b40b7d3593728c1bc1

SHA256
521389c075689b125a4f29ca1782a4d680ea24dfa3fbc3b1f76003a83257dad3

SHA512
f171430c37ddc9903e631977b4a30bfec2a43667cb7f99358c841a6e5b84f50d16b2ec54a1eba559fd06c2cec7e96105bf4d8518cc52fe03300ca5eb2dcf40e7

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\Temp\ShKernel.exe-5.15.9.313-x64.dmp
Filesize
90.4MB

MD5
2747cecd64790106c7d2adbdcfd1ca56

SHA1
5e6596c017e48967e3a4760398ee51578217f056

SHA256
f5e8b0c697fa97080c082837dacaf6b0c17a30b85278d341ce7f4d0e9b2dd536

SHA512
4dddced4438f7bd8f136151c3bde259b8a0c034780af628727fdf9e67ba1ab336518e562ac23120c66025c4ef30e34556ba5036ac05957759653bc29afc58ded

Download Submit
C:\Program Files\EnigmaSoft\SpyHunter\purl.dat
Filesize
128B

MD5
64701b8d93b699c8b60d857e8d2d9b6b

SHA1
9898c7b5045d7aead7386b379431ffeacee2d674

SHA256
41f8cb0b2269dac1d9d9bf2d6c4d073f4751ec197458e338d7bfaca4fe8cba2a

SHA512
fd2cf184cce17895f39787f0a1e760a75dce6eab7df5f4546cc53a77adee137272284888f61d66ad4aeda3156a21a01174c0b382d440aae23698aa7c4f4a5933

Download Submit
C:\ProgramData\Start Menu\Programs\EnigmaSoft\SpyHunter5.lnk
Filesize
1KB

MD5
441359ea45b7cd3c38e5bfd9de8c15f2

SHA1
eb8ff926453244613f0d2beea542470b838f4a4a

SHA256
22c5ddc5c7ad9a3393f9cd3158391041f7e87791df2536f6d10b740225d1e0ed

SHA512
09ebdb3f3aaf25ad0879c67c61b143bd03eaefa7b6a1d564122931c5d2eb27095ee53f7fe128157ed0abdcfe7753b1ab47e3f9f7667625ac0e75ba0f9b83ec6b

Download Submit
C:\ProgramData\Start Menu\Programs\EnigmaSoft\Uninstall.lnk
Filesize
699B

MD5
c08c660064f10a88a1276ab26d020d20

SHA1
75c99ed08455b1a570cdcd95be856c3249904a11

SHA256
31fca4c6fadb51aadab22ae9c3e81d7bd85346f42b5da1825e1c72cd9b3829c9

SHA512
f6c07febbeffaaa26966fd882092e35e8b4457e70363e2641442b4b2412e881b0aab3f75e2d0ac192722f422ec8eb3ff865834898adbac2314ef223c75ec90dd

Download Submit
C:\ProgramData\Start Menu\Programs\SpyHunter5.lnk
Filesize
1KB

MD5
6d344e8ba73dc6a07695b1ca0a1c671a

SHA1
700d53a7a2cd0d4c3d318744ab9cb93fada206ed

SHA256
150132df9a3ec458d86a56058cec2c18d149c987417872371023e6b00f2a2105

SHA512
780ce76d6461bd346ea322ee4ac3c71455072eca158858f00a339a0f8deff2610bf36adb798fb3366f743c2efd2b12ebb7da2276490e9a04653ee44092a2e0ea

Download Submit
C:\Windows\System32\drivers\EnigmaFileMonDriver.sys
Filesize
82KB

MD5
35023b3cf6e48d1a4cc9901afd8da844

SHA1
e50576e17e472f27d057a2f52986116fffbf4b19

SHA256
029b8d7749b9f904919710a787ebcffbe0b1960310cc7c2bb65f4c0f3453fc4b

SHA512
ea41f31efd7ff272ff0803ecd459cf5712afa41472a26252dc2e9cf042bee981f1b037f43e35d8e4599df144eaad44b8d1a29846c9c23cad5fc4a7cd7dd57562

Download Submit
\Program Files\EnigmaSoft\SpyHunter\ShShellExt.dll
Filesize
2.7MB

MD5
d247abcd02547a0843f6cbd354e7d77c

SHA1
bbb0e7255c7a4239fc31f0c631a7d67eef902d19

SHA256
baff569bd191de8798865e5acefb1be5356dad26ab9b6ac125f0f47cdff206d7

SHA512
7b6ed443e96e51ceb204a1563faf0345d415d7930a66cda2bf17db17c014f3f916dab09b9024233bcda19f8b376b7098c6e11a978ef4720b23227f8177d21c89

Download Submit
memory/4888-411-0x0000021F197D0000-0x0000021F197D1000-memory.dmp

Filesize
4KB

Download
memory/4888-408-0x0000021F19E00000-0x0000021F19E02000-memory.dmp

Filesize
8KB

Download
memory/4888-174-0x0000021F19620000-0x0000021F19630000-memory.dmp

Filesize
64KB

Download
memory/4888-192-0x0000021F19E80000-0x0000021F19E90000-memory.dmp

Filesize
64KB

Download
memory/4888-211-0x0000021F197F0000-0x0000021F197F1000-memory.dmp

Filesize
4KB

Download
memory/4888-213-0x0000021F19AF0000-0x0000021F19AF2000-memory.dmp

Filesize
8KB

Download
memory/4888-415-0x0000021F197C0000-0x0000021F197C1000-memory.dmp

Filesize
4KB

Download
memory/4888-215-0x0000021F19E00000-0x0000021F19E02000-memory.dmp

Filesize
8KB

Download
memory/4888-216-0x0000021F1E270000-0x0000021F1E272000-memory.dmp

Filesize
8KB

Download
memory/5064-346-0x00000232D5850000-0x00000232D5852000-memory.dmp

Filesize
8KB

Download
memory/5064-315-0x00000232D54C0000-0x00000232D54C2000-memory.dmp

Filesize
8KB

Download
memory/5064-309-0x00000232D4E90000-0x00000232D4E92000-memory.dmp

Filesize
8KB

Download
memory/5064-307-0x00000232D4E50000-0x00000232D4E52000-memory.dmp

Filesize
8KB

Download
memory/5064-304-0x00000232D4FF0000-0x00000232D4FF2000-memory.dmp

Filesize
8KB

Download
memory/5064-302-0x00000232D4FE0000-0x00000232D4FE2000-memory.dmp

Filesize
8KB

Download
memory/5064-297-0x00000232D4E80000-0x00000232D4E82000-memory.dmp

Filesize
8KB

Download
memory/5064-282-0x00000232D4CB0000-0x00000232D4CB2000-memory.dmp

Filesize
8KB

Download
memory/5064-313-0x00000232D5220000-0x00000232D5222000-memory.dmp

Filesize
8KB

Download
memory/5064-311-0x00000232D5200000-0x00000232D5202000-memory.dmp

Filesize
8KB

Download
memory/5064-317-0x00000232D54D0000-0x00000232D54D2000-memory.dmp

Filesize
8KB

Download
memory/5064-319-0x00000232D54F0000-0x00000232D54F2000-memory.dmp

Filesize
8KB

Download
memory/5064-321-0x00000232D5510000-0x00000232D5512000-memory.dmp

Filesize
8KB

Download
memory/5064-323-0x00000232D5530000-0x00000232D5532000-memory.dmp

Filesize
8KB

Download
memory/5064-325-0x00000232D5550000-0x00000232D5552000-memory.dmp

Filesize
8KB

Download
memory/5064-330-0x00000232D4DC0000-0x00000232D4DE0000-memory.dmp

Filesize
128KB

Download
memory/5064-344-0x00000232D5800000-0x00000232D5802000-memory.dmp

Filesize
8KB

Download
memory/5064-348-0x00000232D5860000-0x00000232D5862000-memory.dmp

Filesize
8KB

Download
memory/5064-354-0x00000232D5590000-0x00000232D55B0000-memory.dmp

Filesize
128KB

Download
memory/5064-355-0x00000232D56D0000-0x00000232D56F0000-memory.dmp

Filesize
128KB

Download