dcrat | a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26

Analysis

max time kernel
99s
max time network
151s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
30-09-2023 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe
Size

430KB
MD5

2b51ba01bf9bed963b76abf052ddfb58
SHA1

bb92c422580b6d0d48cc058b1996ca6a976ca829
SHA256

a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26
SHA512

6f9d41bed14f211b3cc8dbb575ba22f245549617ada380943aca086b69f8aab178a2698a5d0343f9857f477f9ed8521473febfaa6d6fa9b19369cf9487219ae8
SSDEEP

12288:dMrVy90wP6HFgddSUkj4WJVWaUvIE6b6Iiy1NvFl+fJ:Aym+9WmaW6b68jl+B

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Signatures

DcRat 5 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exea033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exeschtasks.exeschtasks.exe

pid	process
3616	schtasks.exe
5716	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe
3316	schtasks.exe
6060	schtasks.exe

Detect Fabookie payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2972-674-0x0000000002B70000-0x0000000002CA1000-memory.dmp	family_fabookie

Detected google phishing page
phishing google
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1920-605-0x0000000004AC0000-0x00000000053AB000-memory.dmp	family_glupteba
behavioral1/memory/1920-631-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/1920-700-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1406.exe	family_redline
behavioral1/memory/1184-575-0x00000000009A0000-0x00000000009FA000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\1406.exe	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

Processes:

3616.exeupdater.exe

description	pid	process	target process
PID 5880 created 3196	5880	3616.exe	Explorer.EXE
PID 5880 created 3196	5880	3616.exe	Explorer.EXE
PID 5880 created 3196	5880	3616.exe	Explorer.EXE
PID 5880 created 3196	5880	3616.exe	Explorer.EXE
PID 5988 created 3196	5988	updater.exe	Explorer.EXE
PID 5988 created 3196	5988	updater.exe	Explorer.EXE
PID 5988 created 3196	5988	updater.exe	Explorer.EXE

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe

Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

4444 netsh.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000\Control Panel\International\Geo\Nation cmd.exe

pid	process
4444	netsh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 26 IoCs

Processes:

v6663846.exea1461244.exeE649.exex9185365.exeE7B1.exex3490328.exex9179884.exex1354664.exeg0286977.exeEB4D.exewmiprvse.exess41.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exekos1.exe1406.exetoolspub2.exeset16.exeis-UTCCB.tmpkos.exepreviewer.exepreviewer.exe3616.exeupdater.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exe

pid	process
4688	v6663846.exe
4508	a1461244.exe
4924	E649.exe
4860	x9185365.exe
3828	E7B1.exe
4616	x3490328.exe
3080	x9179884.exe
4268	x1354664.exe
4408	g0286977.exe
824	EB4D.exe
4232	wmiprvse.exe
2972	ss41.exe
1624	toolspub2.exe
1920	31839b57a4f11171d6abc8bbc4451ee4.exe
1520	kos1.exe
1184	1406.exe
4444	toolspub2.exe
1672	set16.exe
744	is-UTCCB.tmp
5152	kos.exe
5412	previewer.exe
5668	previewer.exe
5880	3616.exe
5988	updater.exe
5180	31839b57a4f11171d6abc8bbc4451ee4.exe
5980	csrss.exe

Loads dropped DLL 3 IoCs

Processes:

is-UTCCB.tmp

pid process

744 is-UTCCB.tmp
744 is-UTCCB.tmp
744 is-UTCCB.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
744	is-UTCCB.tmp
744	is-UTCCB.tmp
744	is-UTCCB.tmp

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

x3490328.exex9179884.exex1354664.exe31839b57a4f11171d6abc8bbc4451ee4.exea033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exev6663846.exeE649.exex9185365.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	x3490328.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	x9179884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup6 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\""	x1354664.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v6663846.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	E649.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x9185365.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

a1461244.exeE7B1.exeg0286977.exeEB4D.exetoolspub2.exeupdater.exe

description	pid	process	target process
PID 4508 set thread context of 2496	4508	a1461244.exe	AppLaunch.exe
PID 3828 set thread context of 4784	3828	E7B1.exe	AppLaunch.exe
PID 4408 set thread context of 380	4408	g0286977.exe	AppLaunch.exe
PID 824 set thread context of 1820	824	EB4D.exe	AppLaunch.exe
PID 1624 set thread context of 4444	1624	toolspub2.exe	toolspub2.exe
PID 5988 set thread context of 3088	5988	updater.exe	explorer.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 7 IoCs

Processes:

is-UTCCB.tmp

description	ioc	process
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-UTCCB.tmp
File created	C:\Program Files (x86)\PA Previewer\is-ES6ON.tmp	is-UTCCB.tmp
File created	C:\Program Files (x86)\PA Previewer\is-R9A52.tmp	is-UTCCB.tmp
File created	C:\Program Files (x86)\PA Previewer\is-7LGH2.tmp	is-UTCCB.tmp
File created	C:\Program Files (x86)\PA Previewer\is-KU3KA.tmp	is-UTCCB.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-UTCCB.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-UTCCB.tmp

Drops file in Windows directory 9 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe31839b57a4f11171d6abc8bbc4451ee4.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3772 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3772	sc.exe

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4304	4508	WerFault.exe	a1461244.exe
2820	3828	WerFault.exe	E7B1.exe
4420	4408	WerFault.exe	g0286977.exe
4920	380	WerFault.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub2.exeAppLaunch.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

3316 schtasks.exe
6060 schtasks.exe
3616 schtasks.exe
5716 schtasks.exe

pid	process
3316	schtasks.exe
6060	schtasks.exe
3616	schtasks.exe
5716	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exenetsh.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 007e47e3f8f3d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0782f4f3f8f3d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0f8547faf8f3d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 15b8f6dff8f3d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d4e3abe6f8f3d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000161cadd68022d7cb587b4e29032db8cebee3fb06945bde7e05209ea6b34ed96c9e4ea85eebaae98406828a83e8404db78c53f81e1057ad5a7fa1	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f6defedef8f3d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3540700546-2554825161-2349363825-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeExplorer.EXE

pid	process
2496	AppLaunch.exe
2496	AppLaunch.exe
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE
3196	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3196 Explorer.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

644

pid	process
3196	Explorer.EXE

pid	process
644

Suspicious behavior: MapViewOfSection 12 IoCs

Processes:

AppLaunch.exeMicrosoftEdgeCP.exenetsh.exe

pid	process
2496	AppLaunch.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe
4444	netsh.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEMicrosoftEdgeCP.exe

description	pid	process
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeDebugPrivilege	948	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	948	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	948	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	948	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

3204 MicrosoftEdge.exe
4176 MicrosoftEdgeCP.exe
948 MicrosoftEdgeCP.exe
4176 MicrosoftEdgeCP.exe

pid	process
3204	MicrosoftEdge.exe
4176	MicrosoftEdgeCP.exe
948	MicrosoftEdgeCP.exe
4176	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exev6663846.exea1461244.exeExplorer.EXEE649.exex9185365.exex3490328.exex9179884.exex1354664.exeE7B1.exeg0286977.exeEB4D.exe

description	pid	process	target process
PID 748 wrote to memory of 4688	748	a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe	v6663846.exe
PID 748 wrote to memory of 4688	748	a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe	v6663846.exe
PID 748 wrote to memory of 4688	748	a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe	v6663846.exe
PID 4688 wrote to memory of 4508	4688	v6663846.exe	a1461244.exe
PID 4688 wrote to memory of 4508	4688	v6663846.exe	a1461244.exe
PID 4688 wrote to memory of 4508	4688	v6663846.exe	a1461244.exe
PID 4508 wrote to memory of 2496	4508	a1461244.exe	AppLaunch.exe
PID 4508 wrote to memory of 2496	4508	a1461244.exe	AppLaunch.exe
PID 4508 wrote to memory of 2496	4508	a1461244.exe	AppLaunch.exe
PID 4508 wrote to memory of 2496	4508	a1461244.exe	AppLaunch.exe
PID 4508 wrote to memory of 2496	4508	a1461244.exe	AppLaunch.exe
PID 4508 wrote to memory of 2496	4508	a1461244.exe	AppLaunch.exe
PID 3196 wrote to memory of 4924	3196	Explorer.EXE	E649.exe
PID 3196 wrote to memory of 4924	3196	Explorer.EXE	E649.exe
PID 3196 wrote to memory of 4924	3196	Explorer.EXE	E649.exe
PID 4924 wrote to memory of 4860	4924	E649.exe	x9185365.exe
PID 4924 wrote to memory of 4860	4924	E649.exe	x9185365.exe
PID 4924 wrote to memory of 4860	4924	E649.exe	x9185365.exe
PID 3196 wrote to memory of 3828	3196	Explorer.EXE	E7B1.exe
PID 3196 wrote to memory of 3828	3196	Explorer.EXE	E7B1.exe
PID 3196 wrote to memory of 3828	3196	Explorer.EXE	E7B1.exe
PID 4860 wrote to memory of 4616	4860	x9185365.exe	x3490328.exe
PID 4860 wrote to memory of 4616	4860	x9185365.exe	x3490328.exe
PID 4860 wrote to memory of 4616	4860	x9185365.exe	x3490328.exe
PID 4616 wrote to memory of 3080	4616	x3490328.exe	x9179884.exe
PID 4616 wrote to memory of 3080	4616	x3490328.exe	x9179884.exe
PID 4616 wrote to memory of 3080	4616	x3490328.exe	x9179884.exe
PID 3080 wrote to memory of 4268	3080	x9179884.exe	x1354664.exe
PID 3080 wrote to memory of 4268	3080	x9179884.exe	x1354664.exe
PID 3080 wrote to memory of 4268	3080	x9179884.exe	x1354664.exe
PID 3196 wrote to memory of 2480	3196	Explorer.EXE	cmd.exe
PID 3196 wrote to memory of 2480	3196	Explorer.EXE	cmd.exe
PID 4268 wrote to memory of 4408	4268	x1354664.exe	g0286977.exe
PID 4268 wrote to memory of 4408	4268	x1354664.exe	g0286977.exe
PID 4268 wrote to memory of 4408	4268	x1354664.exe	g0286977.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 3828 wrote to memory of 4784	3828	E7B1.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 4408 wrote to memory of 380	4408	g0286977.exe	AppLaunch.exe
PID 3196 wrote to memory of 824	3196	Explorer.EXE	EB4D.exe
PID 3196 wrote to memory of 824	3196	Explorer.EXE	EB4D.exe
PID 3196 wrote to memory of 824	3196	Explorer.EXE	EB4D.exe
PID 824 wrote to memory of 4008	824	EB4D.exe	AppLaunch.exe
PID 824 wrote to memory of 4008	824	EB4D.exe	AppLaunch.exe
PID 824 wrote to memory of 4008	824	EB4D.exe	AppLaunch.exe
PID 824 wrote to memory of 1820	824	EB4D.exe	AppLaunch.exe
PID 824 wrote to memory of 1820	824	EB4D.exe	AppLaunch.exe
PID 824 wrote to memory of 1820	824	EB4D.exe	AppLaunch.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe
  "C:\Users\Admin\AppData\Local\Temp\a033178aebaff98609497bdb329f830bace3960a1f09eb86efc56c163f5a7f26.exe"
  2⤵
  - DcRat
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6663846.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6663846.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1461244.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1461244.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 152
        5⤵
        Program crash
        
        PID:4304
- C:\Users\Admin\AppData\Local\Temp\E649.exe
  C:\Users\Admin\AppData\Local\Temp\E649.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9185365.exe
    C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9185365.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3490328.exe
      C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3490328.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x9179884.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x9179884.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x1354664.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x1354664.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\g0286977.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\g0286977.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 568
        9⤵
        Program crash
        
        PID:4920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 148
        8⤵
        Program crash
        
        PID:4420
- C:\Users\Admin\AppData\Local\Temp\E7B1.exe
  C:\Users\Admin\AppData\Local\Temp\E7B1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 252
    3⤵
    - Program crash
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E8EB.bat" "
  2⤵
  - Checks computer location settings
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\EB4D.exe
  C:\Users\Admin\AppData\Local\Temp\EB4D.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1820
- C:\Users\Admin\AppData\Local\Temp\1146.exe
  C:\Users\Admin\AppData\Local\Temp\1146.exe
  2⤵
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\ss41.exe
    "C:\Users\Admin\AppData\Local\Temp\ss41.exe"
    3⤵
    - Executes dropped EXE
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:4444
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    PID:1920
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:5180
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1192
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5068
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        Suspicious behavior: MapViewOfSection
        
        PID:4444
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5644
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3488
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        
        PID:5980
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:6020
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:3616
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:2516
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Modifies data under HKEY_USERS
        
        PID:3900
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:6024
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:5716
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:3772
- - C:\Users\Admin\AppData\Local\Temp\kos1.exe
    "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
    3⤵
    - Executes dropped EXE
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\set16.exe
      "C:\Users\Admin\AppData\Local\Temp\set16.exe"
      4⤵
      Executes dropped EXE
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\is-RL6MF.tmp\is-UTCCB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-RL6MF.tmp\is-UTCCB.tmp" /SL4 $4036A "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:744
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        6⤵
        Executes dropped EXE
        
        PID:5412
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        6⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        7⤵
        
        PID:5520
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        6⤵
        Executes dropped EXE
        
        PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\kos.exe
      "C:\Users\Admin\AppData\Local\Temp\kos.exe"
      4⤵
      Executes dropped EXE
      PID:5152
- C:\Users\Admin\AppData\Local\Temp\1406.exe
  C:\Users\Admin\AppData\Local\Temp\1406.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Users\Admin\AppData\Local\Temp\3616.exe
  C:\Users\Admin\AppData\Local\Temp\3616.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  PID:5880
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4432
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:4960
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5844
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:5916
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:5892
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:5504
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml"
  2⤵
  - DcRat
  - Creates scheduled task(s)
  PID:3316
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:5388
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:2728
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:1084
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5468
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:5648
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:2644
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml"
  2⤵
  - DcRat
  - Creates scheduled task(s)
  PID:6060
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:3088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3204

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4176

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4576

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Executes dropped EXE
PID:4232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5552

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5756

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4732

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:5632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV18IXVA\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6OXE6ZWP\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\TZSWQ2NX\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\867AEDRG.cookie

Filesize
132B

MD5
e88b9c0d647ab510fe32fe7c0d9aa0a9

SHA1
5a86a58b08524cbf78b64e8e6f03bf5f2d57bd60

SHA256
23f724aa22e4c600352326a395845b52c30648d7e825ebc40f36c0a579b484e1

SHA512
68e919531910ef003fa293ad6a5d7c9f47112322d091d59c02cfb7a1e0c7a01e01d0d41f203d47b275d1ccbd3f89faae36468f846495f4e46a3e00ebefde6cf0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\KDXOGPG6.cookie

Filesize
132B

MD5
7eddcb71212b0a19a86366a3e0d8229c

SHA1
ad47e991b34b9c85862d9697a258d277a2f212a3

SHA256
22562bdcdee3a93f7b65f74715921e42e85705828bb37d49e25f51378cd6f6aa

SHA512
53daecfaeebb2f67072b86e512abbaac0d63b8881eecbdf85cee49e5ee300727f7c56eb6a42ea6e86572722722a10fce252a1d03950e0edb2938d9a18b7887a1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
48a81b79b740fce3baba6dde888f01a6

SHA1
24ccab545a148189eaa52a05f0167466240cb698

SHA256
7eadd60e78dc6116e3bf24b1ff4e936b7e418ae180de47ea537e4588a5496329

SHA512
8fb61c8c96595b3b34326dcc3af5898a498d796a2cf48ec20388f7c23694a7ee87c3f0fc5a6038cea2d6f274e08aabfc0cd513e81c7974aaea3daa1e9339faf6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
471B

MD5
b1cf120be2efdd1a92dddf06102485e1

SHA1
fb67695566bb32911be1e6ad5cd75c7b7b6f0b22

SHA256
5ce88da4f811b34d9bbdbe7c8ec8cc21a5266c50ca5fb5d790f9a80185e3a83d

SHA512
193bde138d37bee0173b5f2887536996c36e43ef865434a12e50bcdca5a8cc8938571a9e4a506994e014a989157018b3a41bcc4d31598a05fb42551ef38add5c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
c50f3f909960de0b7a81509737ca9c15

SHA1
2f9374e9f6d377f0772e533bcb6742ea5a4d49a5

SHA256
c4c65a7eb61b02250bd713563e34fa56e039051093e006124f718c213125a9c0

SHA512
57474984f288e5eead90428735a7f7e2ac5ae02d69951db29e353c66efc75f518871a922990db9420baf608236faeb9231740a273fae7576a8642caaa12ef766

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
eab80be15fd4d498822b6ab4337ccec7

SHA1
6bb1ba082f9fc7e91d746666eae85d432b074014

SHA256
cddb6563b2567c20b016363b27731a9ccab34cf38990e2b7681b4ffba2c84580

SHA512
91388985bf80bd3bd6d7e880c72268108202588d4bea77b22d07cc506aa04f7517bd5d87f891999d3c2b84c4a1f61aece4c7419307122ccfb9b6a256ccc9646d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
406B

MD5
8cf3930f6cd38056eb884facc327fed4

SHA1
9490df4ebe7003646d903e4f8fcc5ffe1cf7ec4b

SHA256
79896194e3b71a99d96ffa53e292a599b52209dca2d0f865a3cbe999eaa45e04

SHA512
057a0770b6a690cd6eae9eacff6ceda68a952e385d376536b766642da29a2660a85a4631a138c5c8ddd7da470804d2980255ad14677e3b2c8cfcb4ac08cc3918

Download Submit
C:\Users\Admin\AppData\Local\Temp\1146.exe

Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\1146.exe

Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\1406.exe

Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1406.exe

Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3616.exe

Filesize
5.2MB

MD5
d381d9db9cbd1b60afdfb4f05e52a775

SHA1
d59c52583ca791e07f3e6aec2ee2590ab9bfd67e

SHA256
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9

SHA512
cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861

Download Submit
C:\Users\Admin\AppData\Local\Temp\3616.exe

Filesize
5.2MB

MD5
d381d9db9cbd1b60afdfb4f05e52a775

SHA1
d59c52583ca791e07f3e6aec2ee2590ab9bfd67e

SHA256
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9

SHA512
cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861

Download Submit
C:\Users\Admin\AppData\Local\Temp\E649.exe

Filesize
1.0MB

MD5
26a94d3fea2244861be8140c6acb2b49

SHA1
de730504e44110a9f1923b858cd5ee2a3cd72cd2

SHA256
c9695798ea1e94e39d82b6624fec3f9aea38086b109de06a7e4bd3411e998fa9

SHA512
7b5515a581cfed0afbd99eef41315a82e0494a814dc16f989e1d14a65288d1c67c3f4a7d9892e68f499b8f6b6782b9da72a38887724fe744b532ff93854e1d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\E649.exe

Filesize
1.0MB

MD5
26a94d3fea2244861be8140c6acb2b49

SHA1
de730504e44110a9f1923b858cd5ee2a3cd72cd2

SHA256
c9695798ea1e94e39d82b6624fec3f9aea38086b109de06a7e4bd3411e998fa9

SHA512
7b5515a581cfed0afbd99eef41315a82e0494a814dc16f989e1d14a65288d1c67c3f4a7d9892e68f499b8f6b6782b9da72a38887724fe744b532ff93854e1d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\E7B1.exe

Filesize
276KB

MD5
8fcdd768668c750919704d83e48dc905

SHA1
5c346c0070b1916f34817ef6d70df45be7f6d72e

SHA256
943331c244cbbdccb54759760a2520be456ea2847878d5a61b6c1c239e758f06

SHA512
336dd28205785c3c57e9f70b598b2d1736f27906ffc88edf77b93dd20abf2f722e4d64cde67c0711702d61d7fbcda687569b6f95375e68bcd6c4a58675366563

Download Submit
C:\Users\Admin\AppData\Local\Temp\E7B1.exe

Filesize
276KB

MD5
8fcdd768668c750919704d83e48dc905

SHA1
5c346c0070b1916f34817ef6d70df45be7f6d72e

SHA256
943331c244cbbdccb54759760a2520be456ea2847878d5a61b6c1c239e758f06

SHA512
336dd28205785c3c57e9f70b598b2d1736f27906ffc88edf77b93dd20abf2f722e4d64cde67c0711702d61d7fbcda687569b6f95375e68bcd6c4a58675366563

Download Submit
C:\Users\Admin\AppData\Local\Temp\E8EB.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB4D.exe

Filesize
310KB

MD5
da21b103cbfa0cffc6beab2abcb5be8a

SHA1
a7f250d84b21f61d7b0f6c01e4986aff4a648a40

SHA256
7c3a088040cbd7895bc654dcc40cd0055758ac2e613d170afe04a547528fdc7b

SHA512
b4f02701f6ab3d3b84c68773f220b1089702c2e88ca17a1ec2e355706e41be88d363ac1e0fd9296eff239a4d2e710115ec8aff8c562b8512006ec176aa673b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB4D.exe

Filesize
310KB

MD5
da21b103cbfa0cffc6beab2abcb5be8a

SHA1
a7f250d84b21f61d7b0f6c01e4986aff4a648a40

SHA256
7c3a088040cbd7895bc654dcc40cd0055758ac2e613d170afe04a547528fdc7b

SHA512
b4f02701f6ab3d3b84c68773f220b1089702c2e88ca17a1ec2e355706e41be88d363ac1e0fd9296eff239a4d2e710115ec8aff8c562b8512006ec176aa673b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6663846.exe

Filesize
329KB

MD5
c1c10b541ddbd29cb5b9b329156cef48

SHA1
e8a818bdc478dd200826a866f8bf05929fae3130

SHA256
210d4195c7a2a6230c576ed0bd1e425aca7c0749c53d0002cfccc0b4f9c61138

SHA512
c4b9c46c0603b1e864550d30bebcbb66909c3aefd4fba38118f3a6e74ff396eb5c21d1f551c6efc9440772974f12b5eca0e6a575931015e18f6a6d3b82c76c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6663846.exe

Filesize
329KB

MD5
c1c10b541ddbd29cb5b9b329156cef48

SHA1
e8a818bdc478dd200826a866f8bf05929fae3130

SHA256
210d4195c7a2a6230c576ed0bd1e425aca7c0749c53d0002cfccc0b4f9c61138

SHA512
c4b9c46c0603b1e864550d30bebcbb66909c3aefd4fba38118f3a6e74ff396eb5c21d1f551c6efc9440772974f12b5eca0e6a575931015e18f6a6d3b82c76c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1461244.exe

Filesize
166KB

MD5
bcc709b73bb81623c62ce810ddbb7f1a

SHA1
ccd40470072e78ef5d8bf7205db3af12c04e0d8b

SHA256
dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f

SHA512
df8a74518ddbeeb5ed73a9a06690811227b7eb515fc3f58384ca26a130584ba239e92c5b08e0101cbd40f7a02429c00cd4bbb26b409318605a719fd0de8ab954

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1461244.exe

Filesize
166KB

MD5
bcc709b73bb81623c62ce810ddbb7f1a

SHA1
ccd40470072e78ef5d8bf7205db3af12c04e0d8b

SHA256
dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f

SHA512
df8a74518ddbeeb5ed73a9a06690811227b7eb515fc3f58384ca26a130584ba239e92c5b08e0101cbd40f7a02429c00cd4bbb26b409318605a719fd0de8ab954

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9185365.exe

Filesize
931KB

MD5
48b1727650d180d5d2bfc51ea90108e4

SHA1
ad447f7fa768d276b2c5ee37574e93b8594778a3

SHA256
0d7b047cfcada969198aea6162c434d48cbacffec0e6bb06e2f9763275de053f

SHA512
8bc0dddd28bb7dcb45db83cdfa576a99e7cad70f1bc8f409e6b0f5480750b5b1a272a93b08e88581a2495e2e6924c5018110fc2bc1c6149cfe289bf905d46ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9185365.exe

Filesize
931KB

MD5
48b1727650d180d5d2bfc51ea90108e4

SHA1
ad447f7fa768d276b2c5ee37574e93b8594778a3

SHA256
0d7b047cfcada969198aea6162c434d48cbacffec0e6bb06e2f9763275de053f

SHA512
8bc0dddd28bb7dcb45db83cdfa576a99e7cad70f1bc8f409e6b0f5480750b5b1a272a93b08e88581a2495e2e6924c5018110fc2bc1c6149cfe289bf905d46ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3490328.exe

Filesize
748KB

MD5
fc728d6abd04be5401735385b82706b6

SHA1
a5a74781b9a768ef30fa1ba7b890f6049da51352

SHA256
ab2eadf977f954413b51fa720a749cce15d84aca42ff12b674e7a1599f014cf1

SHA512
69007ea0c967734e6995c0dfcdbb0ddbd59cf91518cb61e492af3380f6c9863e51983e994ca589755e76634b7885bdb395236213685108a4240c22b76e8166b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x3490328.exe

Filesize
748KB

MD5
fc728d6abd04be5401735385b82706b6

SHA1
a5a74781b9a768ef30fa1ba7b890f6049da51352

SHA256
ab2eadf977f954413b51fa720a749cce15d84aca42ff12b674e7a1599f014cf1

SHA512
69007ea0c967734e6995c0dfcdbb0ddbd59cf91518cb61e492af3380f6c9863e51983e994ca589755e76634b7885bdb395236213685108a4240c22b76e8166b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x9179884.exe

Filesize
516KB

MD5
3559853a0486dfc73dddbacbdd7d168d

SHA1
192df594266e7782acbfed0a51e7720a3f48a237

SHA256
3d2f43acbd43a31276d831a5f12aa6c89c353673bb044c8d4f6c8db0399f4ed6

SHA512
b7c5efc5db4cf3ff85d58e5bc055980f24a4c0646ce8ee2be3fa1a07ae4397e48bd91758566d751075cbdbb16cb6e826e4a599f042337571a57e26feb2bc11c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\x9179884.exe

Filesize
516KB

MD5
3559853a0486dfc73dddbacbdd7d168d

SHA1
192df594266e7782acbfed0a51e7720a3f48a237

SHA256
3d2f43acbd43a31276d831a5f12aa6c89c353673bb044c8d4f6c8db0399f4ed6

SHA512
b7c5efc5db4cf3ff85d58e5bc055980f24a4c0646ce8ee2be3fa1a07ae4397e48bd91758566d751075cbdbb16cb6e826e4a599f042337571a57e26feb2bc11c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x1354664.exe

Filesize
350KB

MD5
b86a7ec2d00b6390007a92ce3e6e2fdf

SHA1
f204601ad9af77f5f89e583465cfa208315b1fb6

SHA256
b79cb93c8cc1b40b43cdbbed584d00cb8966a9892bb506f820dafe6b05a33c6f

SHA512
58e29caa58fa3b6cd4e3f9e22449ed67288ce7c936eefac9ea2498b909b8f858616caf197769c86daca64d82c76ebc2f7ba86a9fba45628ee57daf8f5db179b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\x1354664.exe

Filesize
350KB

MD5
b86a7ec2d00b6390007a92ce3e6e2fdf

SHA1
f204601ad9af77f5f89e583465cfa208315b1fb6

SHA256
b79cb93c8cc1b40b43cdbbed584d00cb8966a9892bb506f820dafe6b05a33c6f

SHA512
58e29caa58fa3b6cd4e3f9e22449ed67288ce7c936eefac9ea2498b909b8f858616caf197769c86daca64d82c76ebc2f7ba86a9fba45628ee57daf8f5db179b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\g0286977.exe

Filesize
276KB

MD5
36e2da51b07559373a2086a3782677f2

SHA1
df3d784f80514b0f2a21e1ea3c811c582303eba1

SHA256
d6c56fac3d2b69bad7589bb1b4d2ecc790e918c0cf0733065ed8c20160c53f5d

SHA512
5cd2dca321c4b672603350844c4ea4f67507b8db42fe65936f466a94944c95a49c53cf68e50573abd8fe295a86031513df1759ee80889e31c59b77f595bbb11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\g0286977.exe

Filesize
276KB

MD5
36e2da51b07559373a2086a3782677f2

SHA1
df3d784f80514b0f2a21e1ea3c811c582303eba1

SHA256
d6c56fac3d2b69bad7589bb1b4d2ecc790e918c0cf0733065ed8c20160c53f5d

SHA512
5cd2dca321c4b672603350844c4ea4f67507b8db42fe65936f466a94944c95a49c53cf68e50573abd8fe295a86031513df1759ee80889e31c59b77f595bbb11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ktpxr5t.efs.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RL6MF.tmp\is-UTCCB.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RL6MF.tmp\is-UTCCB.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
5.2MB

MD5
d381d9db9cbd1b60afdfb4f05e52a775

SHA1
d59c52583ca791e07f3e6aec2ee2590ab9bfd67e

SHA256
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9

SHA512
cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861

Download Submit
C:\Users\Admin\AppData\Roaming\hitddjs

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
c40aad9846a4ec08d03601514eff68d9

SHA1
898a2d0cea4034e76a57f76267cd1ff91a34511e

SHA256
83ed4a46dd028838c00ebdddc2137ec8c51fa2bac93a47e9f9eba1e56d3bbd6c

SHA512
c69779430d3c1cbdec4443305ea2a2996949d3319372762b0f09c24e4f652f07e0fe246991e3af712ba95e38c78b7abd478e67bf7136329c4379a5de9c626f79

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
ca6806617b52960e205b07cf6c5c9e1b

SHA1
f078f3ce1f8cbd544a8230d358d0329fae4df6ba

SHA256
7f31c909d66b4afe5ff8eef90493394b6ac5314d8e714bff3298ced6655f4738

SHA512
968ec2644ec75089305cb9f78e5630b9798d85c54506dce93a8d20a940ddad8fde652c212b6b66b5675edbb69be3349f4ad3b8c211962854511e0205698f320b

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
\Users\Admin\AppData\Local\Temp\is-R9UUG.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-R9UUG.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
\Users\Admin\AppData\Local\Temp\is-R9UUG.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
memory/380-87-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/380-84-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/380-85-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/744-646-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1184-722-0x000000000A050000-0x000000000A06E000-memory.dmp

Filesize
120KB

Download
memory/1184-575-0x00000000009A0000-0x00000000009FA000-memory.dmp

Filesize
360KB

Download
memory/1184-718-0x0000000009F00000-0x0000000009F76000-memory.dmp

Filesize
472KB

Download
memory/1184-719-0x000000000A150000-0x000000000A312000-memory.dmp

Filesize
1.8MB

Download
memory/1184-720-0x000000000A850000-0x000000000AD7C000-memory.dmp

Filesize
5.2MB

Download
memory/1184-589-0x0000000072A20000-0x000000007310E000-memory.dmp

Filesize
6.9MB

Download
memory/1184-594-0x00000000081F0000-0x0000000008256000-memory.dmp

Filesize
408KB

Download
memory/1184-597-0x00000000078F0000-0x0000000007900000-memory.dmp

Filesize
64KB

Download
memory/1184-690-0x0000000072A20000-0x000000007310E000-memory.dmp

Filesize
6.9MB

Download
memory/1184-584-0x0000000007740000-0x00000000077D2000-memory.dmp

Filesize
584KB

Download
memory/1184-734-0x0000000009390000-0x00000000093E0000-memory.dmp

Filesize
320KB

Download
memory/1184-583-0x0000000007BA0000-0x000000000809E000-memory.dmp

Filesize
5.0MB

Download
memory/1184-586-0x0000000007730000-0x000000000773A000-memory.dmp

Filesize
40KB

Download
memory/1184-697-0x00000000078F0000-0x0000000007900000-memory.dmp

Filesize
64KB

Download
memory/1520-585-0x0000000072A20000-0x000000007310E000-memory.dmp

Filesize
6.9MB

Download
memory/1520-565-0x0000000000240000-0x00000000003B4000-memory.dmp

Filesize
1.5MB

Download
memory/1520-628-0x0000000072A20000-0x000000007310E000-memory.dmp

Filesize
6.9MB

Download
memory/1624-581-0x00000000026B0000-0x00000000026B9000-memory.dmp

Filesize
36KB

Download
memory/1624-579-0x00000000028B0000-0x00000000029B0000-memory.dmp

Filesize
1024KB

Download
memory/1672-599-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1820-133-0x000000000E340000-0x000000000E44A000-memory.dmp

Filesize
1.0MB

Download
memory/1820-127-0x0000000004E10000-0x0000000004E16000-memory.dmp

Filesize
24KB

Download
memory/1820-140-0x000000000E450000-0x000000000E49B000-memory.dmp

Filesize
300KB

Download
memory/1820-566-0x0000000072A20000-0x000000007310E000-memory.dmp

Filesize
6.9MB

Download
memory/1820-136-0x000000000E2D0000-0x000000000E30E000-memory.dmp

Filesize
248KB

Download
memory/1820-135-0x0000000008E80000-0x0000000008E90000-memory.dmp

Filesize
64KB

Download
memory/1820-609-0x0000000008E80000-0x0000000008E90000-memory.dmp

Filesize
64KB

Download
memory/1820-134-0x000000000E270000-0x000000000E282000-memory.dmp

Filesize
72KB

Download
memory/1820-132-0x000000000E820000-0x000000000EE26000-memory.dmp

Filesize
6.0MB

Download
memory/1820-89-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1820-117-0x0000000072A20000-0x000000007310E000-memory.dmp

Filesize
6.9MB

Download
memory/1920-595-0x00000000046B0000-0x0000000004AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1920-631-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/1920-605-0x0000000004AC0000-0x00000000053AB000-memory.dmp

Filesize
8.9MB

Download
memory/1920-700-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/1920-695-0x00000000046B0000-0x0000000004AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2496-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2496-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2496-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2972-673-0x00000000029F0000-0x0000000002B61000-memory.dmp

Filesize
1.4MB

Download
memory/2972-572-0x00007FF76AA70000-0x00007FF76AADA000-memory.dmp

Filesize
424KB

Download
memory/2972-674-0x0000000002B70000-0x0000000002CA1000-memory.dmp

Filesize
1.2MB

Download
memory/3196-18-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/3204-441-0x0000021730E70000-0x0000021730E71000-memory.dmp

Filesize
4KB

Download
memory/3204-93-0x000002172A320000-0x000002172A330000-memory.dmp

Filesize
64KB

Download
memory/3204-131-0x000002172A660000-0x000002172A662000-memory.dmp

Filesize
8KB

Download
memory/3204-438-0x0000021730E60000-0x0000021730E61000-memory.dmp

Filesize
4KB

Download
memory/3204-109-0x000002172A800000-0x000002172A810000-memory.dmp

Filesize
64KB

Download
memory/3340-472-0x000002B0F6400000-0x000002B0F6402000-memory.dmp

Filesize
8KB

Download
memory/3340-460-0x000002B0F63D0000-0x000002B0F63D2000-memory.dmp

Filesize
8KB

Download
memory/3340-440-0x000002B0F4EF0000-0x000002B0F4EF2000-memory.dmp

Filesize
8KB

Download
memory/3340-453-0x000002B0F5EB0000-0x000002B0F5EB2000-memory.dmp

Filesize
8KB

Download
memory/3340-297-0x000002B0F3E30000-0x000002B0F3E50000-memory.dmp

Filesize
128KB

Download
memory/3340-410-0x000002B0F4340000-0x000002B0F4342000-memory.dmp

Filesize
8KB

Download
memory/3340-326-0x000002B0F3E50000-0x000002B0F3E70000-memory.dmp

Filesize
128KB

Download
memory/3340-467-0x000002B0F63F0000-0x000002B0F63F2000-memory.dmp

Filesize
8KB

Download
memory/3340-420-0x000002B0F4720000-0x000002B0F4722000-memory.dmp

Filesize
8KB

Download
memory/3340-475-0x000002B0F6410000-0x000002B0F6412000-memory.dmp

Filesize
8KB

Download
memory/3340-425-0x000002B0F4EE0000-0x000002B0F4EE2000-memory.dmp

Filesize
8KB

Download
memory/3340-486-0x000002B0E2D40000-0x000002B0E2E40000-memory.dmp

Filesize
1024KB

Download
memory/3340-479-0x000002B0F5880000-0x000002B0F5980000-memory.dmp

Filesize
1024KB

Download
memory/4444-582-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4444-668-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4784-76-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4784-90-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4784-80-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4784-75-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4784-72-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4936-249-0x0000024253430000-0x0000024253450000-memory.dmp

Filesize
128KB

Download
memory/5152-708-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/5152-639-0x00007FFDEE810000-0x00007FFDEF1FC000-memory.dmp

Filesize
9.9MB

Download
memory/5152-707-0x00007FFDEE810000-0x00007FFDEF1FC000-memory.dmp

Filesize
9.9MB

Download
memory/5152-716-0x00007FFDEE810000-0x00007FFDEF1FC000-memory.dmp

Filesize
9.9MB

Download
memory/5152-608-0x0000000000840000-0x0000000000848000-memory.dmp

Filesize
32KB

Download
memory/5152-640-0x0000000002910000-0x0000000002920000-memory.dmp

Filesize
64KB

Download
memory/5412-648-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5412-653-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5668-663-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5668-667-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5904-705-0x0000000006540000-0x0000000006550000-memory.dmp

Filesize
64KB

Download
memory/5904-694-0x0000000072A20000-0x000000007310E000-memory.dmp

Filesize
6.9MB

Download
memory/5904-693-0x0000000006480000-0x00000000064B6000-memory.dmp

Filesize
216KB

Download
memory/5904-696-0x0000000006B80000-0x00000000071A8000-memory.dmp

Filesize
6.2MB

Download
memory/5904-698-0x00000000071B0000-0x00000000071D2000-memory.dmp

Filesize
136KB

Download
memory/5904-699-0x00000000071E0000-0x0000000007246000-memory.dmp

Filesize
408KB

Download
memory/5904-702-0x0000000007520000-0x0000000007870000-memory.dmp

Filesize
3.3MB

Download
memory/5904-706-0x0000000006540000-0x0000000006550000-memory.dmp

Filesize
64KB

Download
memory/5904-713-0x0000000007900000-0x000000000791C000-memory.dmp

Filesize
112KB

Download