xehook | hxxps://www[.]mediafire[.]com/file/nim0ut2caef821k/Rz_Laun_v_6[.]3[.]5[.]rar/file

Analysis

max time kernel
329s
max time network
324s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/nim0ut2caef821k/Rz_Laun_v_6.3.5.rar/file

Score

10^/10

xehook credential_access discovery execution persistence privilege_escalation stealer

Malware Config

Extracted

Family

xehook

Version

2.1.5 Stable

https://t.me/+w897k5UK_jIyNDgy

Attributes

id
185
token
xehook185936398232728

Signatures

Xehook stealer
Xehook is an infostealer written in C#.
stealer xehook
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

Powershell.exepowershell.exePowershell.exepowershell.exe

pid	Process
3112	Powershell.exe
548	powershell.exe
1120	Powershell.exe
3112	Powershell.exe
1648	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7zFM.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	7zFM.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

Processes:

7zFM.exeRzlauncher Setup.exejavaw.exeZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe

pid	Process
5236	7zFM.exe
4592	Rzlauncher Setup.exe
5656	javaw.exe
4136	ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe

Loads dropped DLL 18 IoCs

Processes:

7zFM.exejavaw.exeZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe

pid	Process
5236	7zFM.exe
3380
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
5656	javaw.exe
4136	ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
579	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe

description	pid	Process	procid_target
PID 4136 set thread context of 5604	4136	ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe	197

Drops file in Program Files directory 64 IoCs

Processes:

7z2408-x64.exe

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2408-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4556	5604	WerFault.exe	197

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RdrCEF.exeRdrCEF.exe7z2408-x64.exejavaw.exepowershell.exepowershell.exeRdrCEF.exeRdrCEF.exeRdrCEF.exeZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exeMSBuild.exeAcroRd32.exeRzlauncher Setup.exePowershell.exeexplorer.exeRdrCEF.exePowershell.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rzlauncher Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exetaskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133707498782418037"	msedge.exe

Modifies registry class 26 IoCs

Processes:

msedge.exemsedge.exe7z2408-x64.exe7zFM.exeOpenWith.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{B11FFF4E-A4EF-4006-8E08-8C0BDDCE7F88}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{A66D96A6-231D-446F-B508-17DEF8C99C2C}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
5264	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AcroRd32.exePowershell.exePowershell.exetaskmgr.exepowershell.exepowershell.exemsedge.exe

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
3112	Powershell.exe
3112	Powershell.exe
1120	Powershell.exe
1120	Powershell.exe
3112	Powershell.exe
1120	Powershell.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
548	powershell.exe
548	powershell.exe
1648	powershell.exe
1648	powershell.exe
548	powershell.exe
1648	powershell.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
4780	msedge.exe
4780	msedge.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

OpenWith.exeOpenWith.exe7zFM.exetaskmgr.exe

pid	Process
5804	OpenWith.exe
5680	OpenWith.exe
5236	7zFM.exe
3860	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

7zFM.exePowershell.exePowershell.exetaskmgr.exepowershell.exepowershell.exesvchost.exeMSBuild.exetaskmgr.exe

description	pid	Process
Token: SeRestorePrivilege	5236	7zFM.exe
Token: 35	5236	7zFM.exe
Token: SeSecurityPrivilege	5236	7zFM.exe
Token: SeSecurityPrivilege	5236	7zFM.exe
Token: SeSecurityPrivilege	5236	7zFM.exe
Token: SeSecurityPrivilege	5236	7zFM.exe
Token: SeSecurityPrivilege	5236	7zFM.exe
Token: SeDebugPrivilege	1120	Powershell.exe
Token: SeDebugPrivilege	3112	Powershell.exe
Token: SeDebugPrivilege	3860	taskmgr.exe
Token: SeSystemProfilePrivilege	3860	taskmgr.exe
Token: SeCreateGlobalPrivilege	3860	taskmgr.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeSecurityPrivilege	3860	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3860	taskmgr.exe
Token: SeBackupPrivilege	1204	svchost.exe
Token: SeRestorePrivilege	1204	svchost.exe
Token: SeSecurityPrivilege	1204	svchost.exe
Token: SeTakeOwnershipPrivilege	1204	svchost.exe
Token: 35	1204	svchost.exe
Token: SeDebugPrivilege	5604	MSBuild.exe
Token: 33	3860	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3860	taskmgr.exe
Token: SeBackupPrivilege	1204	svchost.exe
Token: SeRestorePrivilege	1204	svchost.exe
Token: SeSecurityPrivilege	1204	svchost.exe
Token: SeTakeOwnershipPrivilege	1204	svchost.exe
Token: 35	1204	svchost.exe
Token: SeDebugPrivilege	5976	taskmgr.exe
Token: SeSystemProfilePrivilege	5976	taskmgr.exe
Token: SeCreateGlobalPrivilege	5976	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zFM.exetaskmgr.exe

pid	Process
5236	7zFM.exe
5236	7zFM.exe
5236	7zFM.exe
5236	7zFM.exe
5236	7zFM.exe
5236	7zFM.exe
5236	7zFM.exe
5236	7zFM.exe
5236	7zFM.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exetaskmgr.exe

pid	Process
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
3860	taskmgr.exe
5976	taskmgr.exe

Suspicious use of SetWindowsHookEx 38 IoCs

Processes:

OpenWith.exeAcroRd32.exe7z2408-x64.exeOpenWith.exejavaw.exe

pid	Process
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
5804	OpenWith.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe
5644	7z2408-x64.exe
2676	AcroRd32.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5680	OpenWith.exe
5656	javaw.exe
5656	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exeAcroRd32.exeRdrCEF.exe

description	pid	Process	procid_target
PID 5804 wrote to memory of 2676	5804	OpenWith.exe	131
PID 5804 wrote to memory of 2676	5804	OpenWith.exe	131
PID 5804 wrote to memory of 2676	5804	OpenWith.exe	131
PID 2676 wrote to memory of 3040	2676	AcroRd32.exe	137
PID 2676 wrote to memory of 3040	2676	AcroRd32.exe	137
PID 2676 wrote to memory of 3040	2676	AcroRd32.exe	137
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 2628	3040	RdrCEF.exe	138
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139
PID 3040 wrote to memory of 1876	3040	RdrCEF.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/nim0ut2caef821k/Rz_Laun_v_6.3.5.rar/file
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4040,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
1⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4596,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:1
1⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5404,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
1⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5420,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5812,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
1⤵
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6224,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
1⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=4704,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
1⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=3792,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
1⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6508,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
1⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6520,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
1⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6788,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
1⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=7004,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
1⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=7144,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
1⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=7312,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
1⤵
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=7712,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:8
1⤵
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=7752,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
1⤵
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=8044,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
1⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=8396,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
1⤵
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=7516,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:1
1⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --field-trial-handle=8504,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:1
1⤵
PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=8116,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=8516 /prefetch:1
1⤵
PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --field-trial-handle=8440,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
1⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5464,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
1⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=7656,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:8
1⤵
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5688,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
1⤵
PID:5776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Rz_Laun_v_6.3.5.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8705D2BC5D6D035CD2A53457C3610B5A --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3871ADDB029F2FE1E7C2B81380D0E82E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3871ADDB029F2FE1E7C2B81380D0E82E --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:1876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=449D9AA6054A0112FCF75EEDFEB24C41 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:604
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5DA5712A07ADA2FC4C150C087C35C746 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:6100
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=368892D7E945CE95A97A75A18095E2F1 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=5768,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
1⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --field-trial-handle=5164,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --field-trial-handle=6216,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
1⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=8456,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:8
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --field-trial-handle=5440,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
1⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --field-trial-handle=7876,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
1⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=7336,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
1⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=6236,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
1⤵
- Modifies registry class
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --field-trial-handle=6156,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
1⤵
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --field-trial-handle=6684,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
1⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --field-trial-handle=6476,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
1⤵
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --field-trial-handle=7328,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
1⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=8616,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:8
1⤵
PID:1912

C:\Users\Admin\Downloads\7z2408-x64.exe
"C:\Users\Admin\Downloads\7z2408-x64.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5680

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5236
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO47452E5B\P.S.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c6fbd198,0x7ff9c6fbd1a4,0x7ff9c6fbd1b0
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2312,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1980,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:3
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2232,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4520,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4520,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4764,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4768,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4776,i,11737235191731501089,11417171104824073603,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:5512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1448

C:\Users\Admin\Desktop\Rzlauncher Setup.exe
"C:\Users\Admin\Desktop\Rzlauncher Setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4592
- C:\Users\Admin\Desktop\jre\bin\javaw.exe
  "C:\Users\Admin\Desktop\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\activation.jar;lib\asm-all.jar;lib\commons-email.jar;lib\cs2 skin.mp4;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jfoenix.jar;lib\jkeymaster.jar;lib\jna.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-desktop-hotkey-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-mail-ext.jar;lib\jphp-runtime.jar;lib\jphp-systemtray-ext.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\mail.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zenless zero.mp4;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command "Add-MpPreference -Force -ExclusionPath "C:\""' -Verb RunAs}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -Force -ExclusionPath C:"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:548
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command "Set-MpPreference -Force -DisableBehaviorMonitoring "' -Verb RunAs}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -Force -DisableBehaviorMonitoring
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1648
- - C:\Windows\SysWOW64\explorer.exe
    explorer C:\Users\Admin\AppData\Local\Temp\ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3340

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4624
- C:\Users\Admin\AppData\Local\Temp\ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe
  "C:\Users\Admin\AppData\Local\Temp\ZjNjNWNkMDFhMDAxNzFmZjA3ZThlODg1M2U5M2M1ZTE.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 1968
      4⤵
      Program crash
      PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5604 -ip 5604
1⤵
PID:3848

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
963KB

MD5
004d7851f74f86704152ecaaa147f0ce

SHA1
45a9765c26eb0b1372cb711120d90b5f111123b3

SHA256
028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be

SHA512
16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
4b52cda68417a07dec8031edebb763c9

SHA1
a98edc1ca1672bd66c154e9c1e2b80cbc468701b

SHA256
88612cf691a8f0fbbf743bd84fba5cba3ccba0e215c0f624da49b54213cb7498

SHA512
27288df3d92e7e983d736183eaee3a3455556077b0ca3a7eb5e5faa3fc3ca3ab5871856d566fdb260752502599b02750a0bfad2dbad8b3fadb1c5eacdfbb8298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
13KB

MD5
21fa9f71612bffacec9cd47aae317f0a

SHA1
7703ae1b5836d492f7bf238a97cd85e6f0f25985

SHA256
b4b2086c12601457d15e2fafad5a936238438438d3807fdcdaeda98f574a3a69

SHA512
33a412350890fe3015987b7d4ac81c14283e64b010a481ca9fece53ffeecfca09f400427d36b0c5d49f39be0c367f7ad36b6f315f4fb237bf761f98416c3a92c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
12614afe2d6fa7b663b6dec637409b50

SHA1
5f34142195a197d194b89a52938f9e73a04dd6b5

SHA256
70cf46d1e9661a9f37826d4879b4aab545c1c506ff866715b9ff7221eb60be42

SHA512
eabee904c2923c9efdde808062cbfeed582f3b28505b6e7da776b1d286ce08f25f5418ce2cf4b268b4b9138af6dd0f331887f308598de2565a9755e515f30ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0f432f473e85bd95031ff722b210b3a9

SHA1
ad70a6be0029844bc69cf3544f4e99fdb7e954e8

SHA256
0a8e929319640d84c835dcbe1b9858a32535426fdb94bc682f2d6102a5f3eac0

SHA512
a3010e1086d2ae83153ecc31e57a4e1dd7dd5534d293cf9c9e358ed633742f320ca336caab08e4c202e0118aff902fecd4b5170791e1aa311f541d7f0ee8672c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
7d64ab906a0d6579928f1c9ca871f04f

SHA1
a8d4c4c52ecfb687060704de47200c0e60a9b231

SHA256
09ae13f26bde3a4eb81ef4f97cf605695450e3b57a43b6c2087b486c0a7afaa9

SHA512
86aaab5e2f1a96fd1f11e716c5c08d14e537a1da3c1801989f253f4f8309a8a50cf402694cc212e4bf46fa84e511629bd173cdb6f12d8ac0d90ffecfd30c0f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
85KB

MD5
02a93d19c3ed515a26a4c574a9b9a6cb

SHA1
dfe88cca672fec70290a6061534b8f4746e9c7b1

SHA256
5069ef77437ac8c4f8adc3f8fb1851a30ff7177403e7fc89ca9ae5c76fcb8e16

SHA512
0a7cad6a07ace2cb671a621a520a5da19ab9319f87eb15552e88853b4fa7972f298a46e5e7572c2d9da6c26cd6b6f419a3521f7862bc1661c25cc6c5e7ef953e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
89KB

MD5
3bc8e15cdc81fd3213a5efd86dad2fb6

SHA1
2d02c9dbd7cbdd25dae3151cd021ed593984bf43

SHA256
086056d084333e79dd25a292a7943fb9ffa3aca86264f4572cb86932a3704ee9

SHA512
499fe7cf2849f3edbf8eed5106094ba880098c378e626e0a9b0fe029aa2cfe249774956b24d85ee09674eed15ed221f9d7b6ae925cf4e89c92d6bb3735c2003c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
85KB

MD5
3b44a30c393fe3ea401fa45839b42023

SHA1
f43a778ed3bfc3d69bfea8dd1849683bf90132bc

SHA256
daa16e6299b44ee4fc8dc912059353623de2a36fc0ad5c436afc7fa99d0bc197

SHA512
c765a1f26754a0365b7e39335fe75fa673719ed3c9f90427d94cb05a654ddb5c0a2457a05df187dc431362f7b3b5c9064eee07c7fafd4b429f66e4b8b81191d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE474E1BDB\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO47452E5B\P.S.txt

Filesize
229B

MD5
a87a452b961038777f25859ea1709faa

SHA1
dd3b45ad4d1a038c5ab237c564696b816a41160a

SHA256
5f0b5da62f14658a9722aedd1a2822c1eafbf624c20349515309520a30a149f6

SHA512
634a3dd0b8e05bd2d8b962e62ca7ff9e25a7ff297ecd0c87d38dbda34c02f4fcb68646f52e0ec4b2f2c72fed2d61d103bf493afa3622bdb9d235aef7f472fd5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0hzvh5e.0kn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\Rzlauncher Setup.exe

Filesize
32KB

MD5
c919047959690a1646e561e81d45e5fd

SHA1
5bd528b9f0ec25ea19f0d0bbba41f4422597a488

SHA256
a9f0a76d6e73189b7385b6fcddeccb50e67b65c315b5c20108f86f22fce17802

SHA512
dee29e35b748bb69d0acc56d744eebd50cd462a93178072f9585dadd0c12b93907d7572832733ed0ba255909ae665a8cb102a360acfe3729365ea123480c3fca

Download Submit
C:\Users\Admin\Desktop\jre\bin\client\jvm.dll

Filesize
3.7MB

MD5
39c302fe0781e5af6d007e55f509606a

SHA1
23690a52e8c6578de6a7980bb78aae69d0f31780

SHA256
b1fbdbb1e4c692b34d3b9f28f8188fc6105b05d311c266d59aa5e5ec531966bc

SHA512
67f91a75e16c02ca245233b820df985bd8290a2a50480dff4b2fd2695e3cf0b4534eb1bf0d357d0b14f15ce8bd13c82d2748b5edd9cc38dc9e713f5dc383ed77

Download Submit
C:\Users\Admin\Desktop\jre\bin\java.dll

Filesize
123KB

MD5
73bd0b62b158c5a8d0ce92064600620d

SHA1
63c74250c17f75fe6356b649c484ad5936c3e871

SHA256
e7b870deb08bc864fa7fd4dec67cef15896fe802fafb3009e1b7724625d7da30

SHA512
eba1cf977365446b35740471882c5209773a313de653404a8d603245417d32a4e9f23e3b6cd85721143d2f9a0e46ed330c3d8ba8c24aee390d137f9b5cd68d8f

Download Submit
C:\Users\Admin\Desktop\jre\bin\javaw.exe

Filesize
187KB

MD5
48c96771106dbdd5d42bba3772e4b414

SHA1
e84749b99eb491e40a62ed2e92e4d7a790d09273

SHA256
a96d26428942065411b1b32811afd4c5557c21f1d9430f3696aa2ba4c4ac5f22

SHA512
9f891c787eb8ceed30a4e16d8e54208fa9b19f72eeec55b9f12d30dc8b63e5a798a16b1ccc8cea3e986191822c4d37aedb556e534d2eb24e4a02259555d56a2c

Download Submit
C:\Users\Admin\Desktop\jre\bin\msvcr100.dll

Filesize
755KB

MD5
bf38660a9125935658cfa3e53fdc7d65

SHA1
0b51fb415ec89848f339f8989d323bea722bfd70

SHA256
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

SHA512
25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

Download Submit
C:\Users\Admin\Desktop\jre\bin\verify.dll

Filesize
38KB

MD5
de2167a880207bbf7464bcd1f8bc8657

SHA1
0ff7a5ea29c0364a1162a090dffc13d29bc3d3c7

SHA256
fd856ea783ad60215ce2f920fcb6bb4e416562d3c037c06d047f1ec103cd10b3

SHA512
bb83377c5cff6117cec6fbadf6d40989ce1ee3f37e4ceba17562a59ea903d8962091146e2aa5cc44cfdddf280da7928001eea98abf0c0942d69819b2433f1322

Download Submit
C:\Users\Admin\Desktop\jre\bin\zip.dll

Filesize
68KB

MD5
cb99b83bbc19cd0e1c2ec6031d0a80bc

SHA1
927e1e24fd19f9ca8b5191ef3cc746b74ab68bcd

SHA256
68148243e3a03a3a1aaf4637f054993cb174c04f6bd77894fe84d74af5833bec

SHA512
29c4978fa56f15025355ce26a52bdf8197b8d8073a441425df3dfc93c7d80d36755cc05b6485dd2e1f168df2941315f883960b81368e742c4ea8e69dd82fa2ba

Download Submit
C:\Users\Admin\Desktop\jre\lib\currency.data

Filesize
4KB

MD5
f6258230b51220609a60aa6ba70d68f3

SHA1
b5b95dd1ddcd3a433db14976e3b7f92664043536

SHA256
22458853da2415f7775652a7f57bb6665f83a9ae9fb8bd3cf05e29aac24c8441

SHA512
b2dfcfdebf9596f2bb05f021a24335f1eb2a094dca02b2d7dd1b7c871d5eecda7d50da7943b9f85edb5e92d9be6b6adfd24673ce816df3960e4d68c7f894563f

Download Submit
C:\Users\Admin\Desktop\jre\lib\ext\jfxrt.jar

Filesize
17.3MB

MD5
042b3675517d6a637b95014523b1fd7d

SHA1
82161caf5f0a4112686e4889a9e207c7ba62a880

SHA256
a570f20f8410f9b1b7e093957bf0ae53cae4731afaea624339aa2a897a635f22

SHA512
7672d0b50a92e854d3bd3724d01084cc10a90678b768e9a627baf761993e56a0c6c62c19155649fe9a8ceeabf845d86cbbb606554872ae789018a8b66e5a2b35

Download Submit
C:\Users\Admin\Desktop\jre\lib\ext\meta-index

Filesize
1KB

MD5
77abe2551c7a5931b70f78962ac5a3c7

SHA1
a8bb53a505d7002def70c7a8788b9a2ea8a1d7bc

SHA256
c557f0c9053301703798e01dc0f65e290b0ae69075fb49fcc0e68c14b21d87f4

SHA512
9fe671380335804d4416e26c1e00cded200687db484f770ebbdb8631a9c769f0a449c661cb38f49c41463e822beb5248e69fd63562c3d8c508154c5d64421935

Download Submit
C:\Users\Admin\Desktop\jre\lib\i386\jvm.cfg

Filesize
657B

MD5
9fd47c1a487b79a12e90e7506469477b

SHA1
7814df0ff2ea1827c75dcd73844ca7f025998cc6

SHA256
a73aea3074360cf62adedc0c82bc9c0c36c6a777c70da6c544d0fba7b2d8529e

SHA512
97b9d4c68ac4b534f86efa9af947763ee61aee6086581d96cbf7b3dbd6fd5d9db4b4d16772dce6f347b44085cef8a6ea3bfd3b84fbd9d4ef763cef39255fbce3

Download Submit
C:\Users\Admin\Desktop\jre\lib\meta-index

Filesize
2KB

MD5
91aa6ea7320140f30379f758d626e59d

SHA1
3be2febe28723b1033ccdaa110eaf59bbd6d1f96

SHA256
4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

SHA512
03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

Download Submit
C:\Users\Admin\Desktop\jre\lib\security\java.security

Filesize
26KB

MD5
409c132fe4ea4abe9e5eb5a48a385b61

SHA1
446d68298be43eb657934552d656fa9ae240f2a2

SHA256
4d9e5a12b8cac8b36ecd88468b1c4018bc83c97eb467141901f90358d146a583

SHA512
7fed286ac9aed03e2dae24c3864edbbf812b65965c7173cc56ce622179eb5f872f77116275e96e1d52d1c58d3cdebe4e82b540b968e95d5da656aa74ad17400d

Download Submit
C:\Users\Admin\Desktop\lib\activation.jar

Filesize
67KB

MD5
46a37512971d8eca81c3fcf245bf07d2

SHA1
485de3a253e23f645037828c07f1d7f1af40763a

SHA256
ae475120e9fcd99b4b00b38329bd61cdc5eb754eee03fe66c01f50e137724f99

SHA512
49119b0cc3af02700685a55c6f15e6d40643f81640e642b9ea39a59e18d542f8837d30b43b5be006ce1a98c8ec9729bb2165c0442978168f64caa2fc6e3cb93d

Download Submit
C:\Users\Admin\Desktop\lib\asm-all.jar

Filesize
241KB

MD5
f5ad16c7f0338b541978b0430d51dc83

SHA1
2ea49e08b876bbd33e0a7ce75c8f371d29e1f10a

SHA256
7fbffbc1db3422e2101689fd88df8384b15817b52b9b2b267b9f6d2511dc198d

SHA512
82e6749f4a6956f5b8dd5a5596ca170a1b7ff4e551714b56a293e6b8c7b092cbec2bec9dc0d9503404deb8f175cbb1ded2e856c6bc829411c8ed311c1861336a

Download Submit
C:\Users\Admin\Desktop\lib\commons-email.jar

Filesize
48KB

MD5
f045afea3cb27ead50b0c59fc3f0dffd

SHA1
c1a7133db9008fa1eae082e6158c3f4c128ec27e

SHA256
268253139a8936afa68909df8ced52a9d769665ee9373a60e19a93f254fd54b5

SHA512
0e2d2cbef9d4c19310748e37ad909e57aa37490a7dfd41557b1914857fe7235e434a6fdee00f663688941da3e70fe882b5c63df10ba8c7ad18936959f906722b

Download Submit
C:\Users\Admin\Desktop\lib\cs2 skin.mp4

Filesize
29.8MB

MD5
2f7673bca9174e64a57f29ca1e7ebde6

SHA1
03a65d9372a3c2525d69d5ec68caa468dbaed7f9

SHA256
525f4d30e77d75e48d4d12eb128180a15a4d38d919e64454904cab45478daa32

SHA512
4c97a01838bbd30e60ddf0e9f0b4a36dcaf095b217fc544e008b0b163e242760ee2f482e7dd84aff2a4d8ce9e53017e1378e22ca7de1fb40186cbdbbac3162cd

Download Submit
C:\Users\Admin\Desktop\lib\dn-compiled-module.jar

Filesize
1.0MB

MD5
1d23a047992eef13c68e96a8c11fc056

SHA1
e47f3e187f77d18b29491b9d39cf0744f968c358

SHA256
53aa97ce411f6f185580c3683cc3b4ba8b8b8c6f0bcd29009243667e7fd33593

SHA512
526a042f2eb0d502b137c3d63648206510ee53f49e449c40d53f3980bb1116bc9998afbbb5f01c591a5fb773112f87dd4ec3ec8fcfbb1f16483ab60f08d9d5f9

Download Submit
C:\Users\Admin\Desktop\lib\dn-php-sdk.jar

Filesize
12KB

MD5
3e5e8cccff7ff343cbfe22588e569256

SHA1
66756daa182672bff27e453eed585325d8cc2a7a

SHA256
0f26584763ef1c5ec07d1f310f0b6504bc17732f04e37f4eb101338803be0dc4

SHA512
8ea5f31e25c3c48ee21c51abe9146ee2a270d603788ec47176c16acac15dad608eef4fa8ca0f34a1bbc6475c29e348bd62b0328e73d2e1071aaa745818867522

Download Submit
C:\Users\Admin\Desktop\lib\gson.jar

Filesize
226KB

MD5
5134a2350f58890ffb9db0b40047195d

SHA1
751f548c85fa49f330cecbb1875893f971b33c4e

SHA256
2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32

SHA512
c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a

Download Submit
C:\Users\Admin\Desktop\lib\jfoenix.jar

Filesize
2.3MB

MD5
6316f84bc78d40b138dab1adc978ca5d

SHA1
b12ea05331ad89a9b09937367ebc20421f17b9ff

SHA256
d637e3326f87a173abd5f51ac98906a3237b9e511d07d31d6aafcf43f33dac17

SHA512
1cdca01ed9c2bc607207c8c51f4b532f4153e94b3846308332eccae25f9c5fddf8279e3063f44a75dd43d696eab0f9f340f9bf2f3ec805ab0f2f1de5135a426c

Download Submit
C:\Users\Admin\Desktop\lib\jkeymaster.jar

Filesize
51KB

MD5
21a017201cbb16ae0546069d4371f1c2

SHA1
9f1e8c9341a8a0c51299b961c4f6c7661c822756

SHA256
a2d68aaf08f15ff1c3b9b224641e8b4c35ee30b10f655d6420571b0429f19c87

SHA512
6c65740c17de72ba7b0df95aa29d095a1502f298924c63f364328f6fbb38920e92e0246d28a642f7c9fe3ab582341e607b0ae01515d470b4595d698ce81363d6

Download Submit
C:\Users\Admin\Desktop\lib\jna.jar

Filesize
1.1MB

MD5
8d536ddbe44d1500d262960891911f91

SHA1
fcc5b10cb812c41b00708e7b57baccc3aee5567c

SHA256
edc2a2c4f9b0b55fdc66aef3c9a9ddfff97e4b892842d4c0e1bc6eaff704abcb

SHA512
0ff97f158d1b1fbbef35813a1be2cc9f0c2321fa66e47af3276d3cb93178e668a652bac8a1aee82986dbf86e6db34518045eddfdd10ca827f3e4762faaa814f3

Download Submit
C:\Users\Admin\Desktop\lib\jphp-app-framework.jar

Filesize
103KB

MD5
0c8768cdeb3e894798f80465e0219c05

SHA1
c4da07ac93e4e547748ecc26b633d3db5b81ce47

SHA256
15f36830124fc7389e312cf228b952024a8ce8601bf5c4df806bc395d47db669

SHA512
35db507a3918093b529547e991ab6c1643a96258fc95ba1ea7665ff762b0b8abb1ef732b3854663a947effe505be667bd2609ffcccb6409a66df605f971da106

Download Submit
C:\Users\Admin\Desktop\lib\jphp-core.jar

Filesize
464KB

MD5
7e5e3d6d352025bd7f093c2d7f9b21ab

SHA1
ad9bfc2c3d70c574d34a752c5d0ebcc43a046c57

SHA256
5b37e8ff2850a4cbb02f9f02391e9f07285b4e0667f7e4b2d4515b78e699735a

SHA512
c19c29f8ad8b6beb3eed40ab7dc343468a4ca75d49f1d0d4ea0b4a5cee33f745893fba764d35c8bd157f7842268e0716b1eb4b8b26dcf888fb3b3f4314844aad

Download Submit
C:\Users\Admin\Desktop\lib\jphp-desktop-ext.jar

Filesize
16KB

MD5
b50e2c75f5f0e1094e997de8a2a2d0ca

SHA1
d789eb689c091536ea6a01764bada387841264cb

SHA256
cf4068ebb5ecd47adec92afba943aea4eb2fee40871330d064b69770cccb9e23

SHA512
57d8ac613805edada6aeba7b55417fd7d41c93913c56c4c2c1a8e8a28bbb7a05aade6e02b70a798a078dc3c747967da242c6922b342209874f3caf7312670cb0

Download Submit
C:\Users\Admin\Desktop\lib\jphp-desktop-hotkey-ext.jar

Filesize
5KB

MD5
22acc05e1efc1d4c5faa0359ce725d47

SHA1
458e7f911d024a3d786e76f256b017b0901f48f8

SHA256
c55c267d954ec9f24226780ee49fa7e1bc2baec3af6bfc0caa6cc1b49d8ca90c

SHA512
b11754f5337a73d317ae311fd4c20c0b548e1163107b741cc9e6d4d9027a8f99551e3184a83f9ad20098092e87ef1741c1e437058b7cac92727124589c303ef5

Download Submit
C:\Users\Admin\Desktop\lib\jphp-gui-ext.jar

Filesize
688KB

MD5
6696368a09c7f8fed4ea92c4e5238cee

SHA1
f89c282e557d1207afd7158b82721c3d425736a7

SHA256
c25d7a7b8f0715729bccb817e345f0fdd668dd4799c8dab1a4db3d6a37e7e3e4

SHA512
0ab24f07f956e3cdcd9d09c3aa4677ff60b70d7a48e7179a02e4ff9c0d2c7a1fc51624c3c8a5d892644e9f36f84f7aaf4aa6d2c9e1c291c88b3cff7568d54f76

Download Submit
C:\Users\Admin\Desktop\lib\jphp-gui-jfoenix-ext.jar

Filesize
50KB

MD5
d093f94c050d5900795de8149cb84817

SHA1
54058dda5c9e66a22074590072c8a48559bba1fb

SHA256
4bec0794a0d69debe2f955bf495ea7c0858ad84cb0d2d549cacb82e70c060cba

SHA512
3faaa415fba5745298981014d0042e8e01850fccaac22f92469765fd8c56b920da877ff3138a629242d9c52e270e7e2ce89e7c69f6902859f48ea0359842e2fb

Download Submit
C:\Users\Admin\Desktop\lib\jphp-json-ext.jar

Filesize
16KB

MD5
fde38932b12fc063451af6613d4470cc

SHA1
bc08c114681a3afc05fb8c0470776c3eae2eefeb

SHA256
9967ea3c3d1aee8db5a723f714fba38d2fc26d8553435ab0e1d4e123cd211830

SHA512
0f211f81101ced5fff466f2aab0e6c807bb18b23bc4928fe664c60653c99fa81b34edf5835fcc3affb34b0df1fa61c73a621df41355e4d82131f94fcc0b0e839

Download Submit
C:\Users\Admin\Desktop\lib\jphp-jsoup-ext.jar

Filesize
19KB

MD5
d963210c02cd1825e967086827da8294

SHA1
26c4d004b5ffdb8f81de2d6b158a3f34819faf01

SHA256
7908145cf17301bedefd6e3af8c93e0320582c0562919ffb56cc21b7fd532b96

SHA512
756c21dc1a02d579f0e2ed39e5bedca5491087cdc28e3e96c8663a493bcfeeeeea44dc40681ec6341426dfa995883dbce11b76d1f921e043ae220399a9e554fb

Download Submit
C:\Users\Admin\Desktop\lib\jphp-mail-ext.jar

Filesize
9KB

MD5
405861c5544a92fb345ebca30dcaec2d

SHA1
f8fe5dcb597fff1bf6489f1283a0157be1a313c3

SHA256
fb206af4ddcc568eb1f7b38b7266be683167c95befef797b0965b4533647b17d

SHA512
f1330e5b39a2af8cf378172d9311a50b65aaa7d0c793b354efbcaa3c843bddeffb756a50f1cb9adaf974c3bb3fa6b5ef4b779e1efeeeb1b3946605f47053fe03

Download Submit
C:\Users\Admin\Desktop\lib\jphp-runtime.jar

Filesize
1.1MB

MD5
d5ef47c915bef65a63d364f5cf7cd467

SHA1
f711f3846e144dddbfb31597c0c165ba8adf8d6b

SHA256
9c287472408857301594f8f7bda108457f6fdae6e25c87ec88dbf3012e5a98b6

SHA512
04aeb956bfcd3bd23b540f9ad2d4110bb2ffd25fe899152c4b2e782daa23a676df9507078ecf1bfc409ddfbe2858ab4c4c324f431e45d8234e13905eb192bae8

Download Submit
C:\Users\Admin\Desktop\lib\jphp-systemtray-ext.jar

Filesize
18KB

MD5
acc229916e4c7c666b45072b525041e7

SHA1
36f508f20347fce608130806a26cd796daf5dd20

SHA256
91ed39e83199784b0fb359a9e2b319572b2ba1b1f4492e82a590bf488650f7f4

SHA512
c537c442874c63103f5ae934b6fdd03834e62b7374070efcbcd05b606d02274679078c38437cb1de79e3284f39fc2981c79274d93b0ba4afeb7c6942cca54235

Download Submit
C:\Users\Admin\Desktop\lib\jphp-xml-ext.jar

Filesize
19KB

MD5
0a79304556a1289aa9e6213f574f3b08

SHA1
7ee3bde3b1777bf65d4f62ce33295556223a26cd

SHA256
434e57fffc7df0b725c1d95cabafdcdb83858ccb3e5e728a74d3cf33a0ca9c79

SHA512
1560703d0c162d73c99cef9e8ddc050362e45209cc8dea6a34a49e2b6f99aae462eae27ba026bdb29433952b6696896bb96998a0f6ac0a3c1dbbb2f6ebc26a7e

Download Submit
C:\Users\Admin\Desktop\lib\jphp-zend-ext.jar

Filesize
95KB

MD5
4bc2aea7281e27bc91566377d0ed1897

SHA1
d02d897e8a8aca58e3635c009a16d595a5649d44

SHA256
4aef566bbf3f0b56769a0c45275ebbf7894e9ddb54430c9db2874124b7cea288

SHA512
da35bb2f67bca7527dc94e5a99a162180b2701ddca2c688d9e0be69876aca7c48f192d0f03d431ccd2d8eec55e0e681322b4f15eba4db29ef5557316e8e51e10

Download Submit
C:\Users\Admin\Desktop\lib\jphp-zip-ext.jar

Filesize
12KB

MD5
20f6f88989e806d23c29686b090f6190

SHA1
1fdb9a66bb5ca587c05d3159829a8780bb66c87d

SHA256
9d5f06d539b91e98fd277fc01fd2f9af6fea58654e3b91098503b235a83abb16

SHA512
2798bb1dd0aa121cd766bd5b47d256b1a528e9db83ed61311fa685f669b7f60898118ae8c69d2a30d746af362b810b133103cbe426e0293dd2111aca1b41ccea

Download Submit
C:\Users\Admin\Desktop\lib\jsoup.jar

Filesize
342KB

MD5
36145fee38e79b81035787f1be296a52

SHA1
33ee82e324f4b1e40167f3dc5e01234a1c5cab61

SHA256
6ebe6abd7775c10a49407ae22db45c840cd2cdaf715866a5b0b5af70941c3f4a

SHA512
3b00b07320831f075a6af9ac1863b8756fe4f99a1b4f2e53578dca17fdaf7bdb147279225045e9eeeba4898fe321cf5457832b8e6a1a5b71acff9a1c10392659

Download Submit
C:\Users\Admin\Desktop\lib\mail.jar

Filesize
496KB

MD5
ec6e4e5ebd85a221b395b8f3b37545e6

SHA1
85319c87280f30e1afc54c355f91f44741beac49

SHA256
17bddec86cfe01092bd358c249b7c2ce4295c13cdad314d8eacc8426fdbe3034

SHA512
3e3e406542676f27b5008a061ceaa90580e2f9fd78b31576c99f7612033f2dd0a14824e7bfb16e6f1a12ad96985319fd6f1c2706230019c76ce22da8c7dfd181

Download Submit
C:\Users\Admin\Desktop\lib\slf4j-api.jar

Filesize
40KB

MD5
caafe376afb7086dcbee79f780394ca3

SHA1
da76ca59f6a57ee3102f8f9bd9cee742973efa8a

SHA256
18c4a0095d5c1da6b817592e767bb23d29dd2f560ad74df75ff3961dbde25b79

SHA512
5dd6271fd5b34579d8e66271bab75c89baca8b2ebeaa9966de391284bd08f2d720083c6e0e1edda106ecf8a04e9a32116de6873f0f88c19c049c0fe27e5d820b

Download Submit
C:\Users\Admin\Desktop\lib\slf4j-simple.jar

Filesize
14KB

MD5
722bb90689aecc523e3fe317e1f0984b

SHA1
8dacf9514f0c707cbbcdd6fd699e8940d42fb54e

SHA256
0966e86fffa5be52d3d9e7b89dd674d98a03eed0a454fbaf7c1bd9493bd9d874

SHA512
d5effbfa105bcd615e56ef983075c9ef0f52bcfdbefa3ce8cea9550f25b859e48b32f2ec9aa7a305c6611a3be5e0cde0d269588d9c2897ca987359b77213331d

Download Submit
C:\Users\Admin\Desktop\lib\zenless zero.mp4

Filesize
19.3MB

MD5
a37254a9dda34e9f2264bf9bfa596998

SHA1
b75f48429c35bc24c76369e8d8026424a0c3d0a9

SHA256
2b45ea3341b1482ef111a70de10d6a8e0562336eedf9421ba8d4e5c0b4e19e48

SHA512
13bd2bb3b04975347b0ea869709861c6697f842eab4bca44d350d53c27b7346964f130cdbf15d78bd567149f83d0f72ca3a1ae4a28a991b6db5c7bdc73b16238

Download Submit
C:\Users\Admin\Desktop\lib\zt-zip.jar

Filesize
102KB

MD5
0fd8bc4f0f2e37feb1efc474d037af55

SHA1
add8fface4c1936787eb4bffe4ea944a13467d53

SHA256
1e31ef3145d1e30b31107b7afc4a61011ebca99550dce65f945c2ea4ccac714b

SHA512
29de5832db5b43fdc99bb7ea32a7359441d6cf5c05561dd0a6960b33078471e4740ee08ffbd97a5ced4b7dd9cc98fad6add43edb4418bf719f90f83c58188149

Download Submit
\??\pipe\crashpad_4780_UGVNPBUTDBZFOHCX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/548-1236-0x0000000006360000-0x000000000637E000-memory.dmp

Filesize
120KB

Download
memory/548-1226-0x000000006E7E0000-0x000000006E82C000-memory.dmp

Filesize
304KB

Download
memory/548-1254-0x0000000007370000-0x0000000007378000-memory.dmp

Filesize
32KB

Download
memory/548-1253-0x0000000007420000-0x000000000743A000-memory.dmp

Filesize
104KB

Download
memory/548-1252-0x0000000007340000-0x0000000007354000-memory.dmp

Filesize
80KB

Download
memory/548-1251-0x0000000007330000-0x000000000733E000-memory.dmp

Filesize
56KB

Download
memory/548-1250-0x00000000072F0000-0x0000000007301000-memory.dmp

Filesize
68KB

Download
memory/548-1239-0x0000000007150000-0x000000000715A000-memory.dmp

Filesize
40KB

Download
memory/548-1238-0x00000000077D0000-0x0000000007E4A000-memory.dmp

Filesize
6.5MB

Download
memory/548-1237-0x0000000006DA0000-0x0000000006E43000-memory.dmp

Filesize
652KB

Download
memory/548-1225-0x0000000006D60000-0x0000000006D92000-memory.dmp

Filesize
200KB

Download
memory/1120-1162-0x0000000005240000-0x0000000005262000-memory.dmp

Filesize
136KB

Download
memory/1120-1161-0x0000000005380000-0x00000000059A8000-memory.dmp

Filesize
6.2MB

Download
memory/1120-1160-0x00000000028C0000-0x00000000028F6000-memory.dmp

Filesize
216KB

Download
memory/1648-1240-0x000000006E7E0000-0x000000006E82C000-memory.dmp

Filesize
304KB

Download
memory/2676-440-0x0000000008700000-0x000000000884D000-memory.dmp

Filesize
1.3MB

Download
memory/3112-1200-0x0000000007340000-0x00000000073D6000-memory.dmp

Filesize
600KB

Download
memory/3112-1181-0x0000000005DA0000-0x00000000060F4000-memory.dmp

Filesize
3.3MB

Download
memory/3112-1163-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/3112-1202-0x00000000068D0000-0x00000000068F2000-memory.dmp

Filesize
136KB

Download
memory/3112-1203-0x0000000007990000-0x0000000007F34000-memory.dmp

Filesize
5.6MB

Download
memory/3112-1164-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/3112-1201-0x0000000006880000-0x000000000689A000-memory.dmp

Filesize
104KB

Download
memory/3112-1186-0x0000000006380000-0x00000000063CC000-memory.dmp

Filesize
304KB

Download
memory/3112-1185-0x0000000006360000-0x000000000637E000-memory.dmp

Filesize
120KB

Download
memory/4136-1343-0x00000000030B0000-0x00000000030B6000-memory.dmp

Filesize
24KB

Download
memory/4136-1342-0x0000000000EE0000-0x0000000000F44000-memory.dmp

Filesize
400KB

Download
memory/4592-964-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/5604-1352-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5604-1376-0x0000000006DF0000-0x0000000006E82000-memory.dmp

Filesize
584KB

Download
memory/5656-1123-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/5656-1118-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/5656-1114-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/5656-1104-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/5656-1077-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/5656-1030-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/5656-1125-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/5656-1032-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download