4c08cca7ac9d329e4e885862e877cc0eec25a23dae9b6265064b57be3fa90181

Resubmissions

25-08-2022 10:41

220825-mrdp9abfcp 10

25-08-2022 10:27

220825-mheaesbdhn 10

Analysis

max time kernel
150s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2022 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iCUESetup_4.27.168_release.msi
Size

1002.7MB
MD5

f9ffbb07216d04c2bd8f39a7a84cca9d
SHA1

04215fb570b465fd3d0e63dd221068b2af2a407a
SHA256

4c08cca7ac9d329e4e885862e877cc0eec25a23dae9b6265064b57be3fa90181
SHA512

f4af8d3600e5d1131c668119a495fde72256c8f06110a398dde988e2ca7159030c6e25ae6efa09ed3b793f09cd90f1cd488030174c6ea24ee94f637929e125e6
SSDEEP

25165824:OcM4l/8abE3G9ieHZNcs1K3BKbLmOZh4h18caz6DsN:OcM4hPN7KxK/TZrYDsN

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

54 780 msiexec.exe
Executes dropped EXE 5 IoCs

Processes:

InstallerGui.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exe

pid process

5200 InstallerGui.exe
5864 QtWebEngineProcess.exe
5724 QtWebEngineProcess.exe
4556 QtWebEngineProcess.exe
812 QtWebEngineProcess.exe

flow	pid	process
54	780	msiexec.exe

pid	process
5200	InstallerGui.exe
5864	QtWebEngineProcess.exe
5724	QtWebEngineProcess.exe
4556	QtWebEngineProcess.exe
812	QtWebEngineProcess.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

QtWebEngineProcess.exeQtWebEngineProcess.exeQtWebEngineProcess.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeInstallerGui.exeQtWebEngineProcess.exe

pid	process
3784	MsiExec.exe
3784	MsiExec.exe
3784	MsiExec.exe
3784	MsiExec.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5864	QtWebEngineProcess.exe
5864	QtWebEngineProcess.exe
5864	QtWebEngineProcess.exe
5864	QtWebEngineProcess.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeInstallerGui.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	InstallerGui.exe
File opened (read-only)	\??\Z:	InstallerGui.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	InstallerGui.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	InstallerGui.exe
File opened (read-only)	\??\O:	InstallerGui.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	InstallerGui.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	InstallerGui.exe
File opened (read-only)	\??\H:	InstallerGui.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	InstallerGui.exe
File opened (read-only)	\??\R:	InstallerGui.exe
File opened (read-only)	\??\U:	InstallerGui.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	InstallerGui.exe
File opened (read-only)	\??\T:	InstallerGui.exe
File opened (read-only)	\??\I:	InstallerGui.exe
File opened (read-only)	\??\S:	InstallerGui.exe
File opened (read-only)	\??\X:	InstallerGui.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	InstallerGui.exe
File opened (read-only)	\??\J:	InstallerGui.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	InstallerGui.exe
File opened (read-only)	\??\Y:	InstallerGui.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	InstallerGui.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	InstallerGui.exe
File opened (read-only)	\??\N:	InstallerGui.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47DC.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B1071BDE-E9F2-4F8C-8A0F-0FB8BA5835CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI916A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9870.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI158F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16F7.tmp	msiexec.exe
File created	C:\Windows\Installer\e59e5d2.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2776 3084 WerFault.exe

pid	pid_target	process	target process
2776	3084	WerFault.exe

Checks SCSI registry key(s) 3 TTPs 61 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies registry class 64 IoCs

Processes:

SearchApp.exeexplorer.exeInstallerGui.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "223"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "256"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2313"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010007000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fec000000000000002000000e60708004100720067006a00620065007800200033000a005600610067007200650061007200670020006e0070007000720066006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000747ed2e17eb8d80100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e60708004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000001d00000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000000abf97e17eb8d80100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a0066000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e6070800420061007200510065007600690072000a0041006200670020006600760074006100720071002000760061000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000002ac982737faed80100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e60708000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000075ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e60708000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e60708000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000082ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e60708000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000083ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1605"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{532B11E5-DED7-480B-B010-6B182848047C}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "3323"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10357"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1624"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "16928"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "16928"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8528"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8348"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1605"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3323"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2954"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8348"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1038"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4693"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7866"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4693"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "16156"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1038"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2313"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "223"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8528"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10357"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2954"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7501"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7577"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4693"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{4D5EA4CC-0F5C-4725-ACAA-6B3347B405CB}	InstallerGui.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7577"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8392"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10357"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7577"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "16156"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7866"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7866"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7592"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1624"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "16928"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1038"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

InstallerGui.exe

pid process

5200 InstallerGui.exe

pid	process
5200	InstallerGui.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exetaskmgr.exechrome.exechrome.exe

pid	process
3648	chrome.exe
3648	chrome.exe
5164	chrome.exe
5164	chrome.exe
5308	chrome.exe
5308	chrome.exe
5568	taskmgr.exe
5568	taskmgr.exe
4864	chrome.exe
4864	chrome.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5952	chrome.exe
5952	chrome.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

explorer.exeInstallerGui.exetaskmgr.exe

pid process

4400 explorer.exe
5200 InstallerGui.exe
5568 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exeexplorer.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	780	msiexec.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeSecurityPrivilege	3388	msiexec.exe
Token: SeShutdownPrivilege	4400	explorer.exe
Token: SeCreatePagefilePrivilege	4400	explorer.exe
Token: SeCreateTokenPrivilege	780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	780	msiexec.exe
Token: SeLockMemoryPrivilege	780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	780	msiexec.exe
Token: SeMachineAccountPrivilege	780	msiexec.exe
Token: SeTcbPrivilege	780	msiexec.exe
Token: SeSecurityPrivilege	780	msiexec.exe
Token: SeTakeOwnershipPrivilege	780	msiexec.exe
Token: SeLoadDriverPrivilege	780	msiexec.exe
Token: SeSystemProfilePrivilege	780	msiexec.exe
Token: SeSystemtimePrivilege	780	msiexec.exe
Token: SeProfSingleProcessPrivilege	780	msiexec.exe
Token: SeIncBasePriorityPrivilege	780	msiexec.exe
Token: SeCreatePagefilePrivilege	780	msiexec.exe
Token: SeCreatePermanentPrivilege	780	msiexec.exe
Token: SeBackupPrivilege	780	msiexec.exe
Token: SeRestorePrivilege	780	msiexec.exe
Token: SeShutdownPrivilege	780	msiexec.exe
Token: SeDebugPrivilege	780	msiexec.exe
Token: SeAuditPrivilege	780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	780	msiexec.exe
Token: SeChangeNotifyPrivilege	780	msiexec.exe
Token: SeRemoteShutdownPrivilege	780	msiexec.exe
Token: SeUndockPrivilege	780	msiexec.exe
Token: SeSyncAgentPrivilege	780	msiexec.exe
Token: SeEnableDelegationPrivilege	780	msiexec.exe
Token: SeManageVolumePrivilege	780	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msiexec.exeexplorer.exetaskmgr.exe

pid	process
780	msiexec.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe
5568	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

explorer.exe

pid	process
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe
4400	explorer.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

StartMenuExperienceHost.exeexplorer.exeSearchApp.exeInstallerGui.exe

pid	process
4736	StartMenuExperienceHost.exe
4400	explorer.exe
1336	SearchApp.exe
4400	explorer.exe
4400	explorer.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe
5200	InstallerGui.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeexplorer.exeInstallerGui.exe

description	pid	process	target process
PID 3388 wrote to memory of 3784	3388	msiexec.exe	MsiExec.exe
PID 3388 wrote to memory of 3784	3388	msiexec.exe	MsiExec.exe
PID 3784 wrote to memory of 5200	3784	MsiExec.exe	InstallerGui.exe
PID 3784 wrote to memory of 5200	3784	MsiExec.exe	InstallerGui.exe
PID 4400 wrote to memory of 5568	4400	explorer.exe	taskmgr.exe
PID 4400 wrote to memory of 5568	4400	explorer.exe	taskmgr.exe
PID 5200 wrote to memory of 5864	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5864	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 5724	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe
PID 5200 wrote to memory of 4556	5200	InstallerGui.exe	QtWebEngineProcess.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\iCUESetup_4.27.168_release.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:780

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 808 -p 3084 -ip 3084
1⤵
PID:2364

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3084 -s 2104
1⤵
- Program crash
PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:2
1⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2000 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:8
1⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
1⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
1⤵
PID:3428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
1⤵
PID:2028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4368 /prefetch:8
1⤵
PID:5068

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5568

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4736

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding E820C61A38C3F8DC4F0F75FC02B13523 U
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3784

C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\InstallerGui.exe
"C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\InstallerGui.exe" "C:\Users\Admin\AppData\Local\Temp\iCUESetup_4.27.168_release.msi" --path-mem-name=B4E0D3C4-AB2D-4F59-B545-B2220C6ECBF0 --path-mem-size=522
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200

C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe
"C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --use-gl=angle --application-name=CORSAIR%20iCUE%204%20Software --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=2628 /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5864

C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe
"C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-databases --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=3964 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:5724

C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe
"C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-databases --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=4040 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:4556

C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe
"C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-databases --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2856 /prefetch:1
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:812

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7B4EA1DC02137E4283B30057E3F46084
2⤵
PID:5984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4916 /prefetch:8
1⤵
PID:5004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5188 /prefetch:8
1⤵
PID:5172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
1⤵
PID:5276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5100 /prefetch:8
1⤵
PID:5376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
1⤵
PID:5476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x520
1⤵
PID:5608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
1⤵
PID:5932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2816 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5076 /prefetch:8
1⤵
PID:2388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5500 /prefetch:8
1⤵
PID:312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5136 /prefetch:2
1⤵
PID:2324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7465874069373218989,6857221438832909592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
1⤵
PID:752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI5137\InstallerGui.exe
Filesize
19.0MB

MD5
c2189029154d736788ecb194dd29d6d9

SHA1
0bfaaeb5e31d98263e58e872f5cd16c725320ee5

SHA256
9e9cd4742c2122297c72a0099c88a8108bf5a6cc45bb4e2375d1a98103933ac6

SHA512
35c0fb50781825850facc1a2eadc75e4f4143778e397017d4aca41f8cb217d2940dc6d99faaa5d4c9dc47cf3d186e3b6f5506f09bc4d9de8604b7f3f054b2ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\InstallerGuiBootstrap.dll
Filesize
293KB

MD5
82154ecfb8b25884a2790ee1d41e3130

SHA1
97024324de6a12c5f562eb2e0e9a951a30d81dac

SHA256
87471c9fa767fbf7a64cd46821e30f4e1f33c90eb8a7fec65418af3fd2cc3b2c

SHA512
c7afee556694e7a4c382325f6ea4c2243b9090de4715b5fa3f80e47fdd7953e774e90f2f691012a1c0ddf90d9a44a518a03359b5f463e6e5f71ed6e02b65ae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\InstallerGuiBootstrap.dll
Filesize
293KB

MD5
82154ecfb8b25884a2790ee1d41e3130

SHA1
97024324de6a12c5f562eb2e0e9a951a30d81dac

SHA256
87471c9fa767fbf7a64cd46821e30f4e1f33c90eb8a7fec65418af3fd2cc3b2c

SHA512
c7afee556694e7a4c382325f6ea4c2243b9090de4715b5fa3f80e47fdd7953e774e90f2f691012a1c0ddf90d9a44a518a03359b5f463e6e5f71ed6e02b65ae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\Qt5Core.dll
Filesize
5.7MB

MD5
817520432a42efa345b2d97f5c24510e

SHA1
fea7b9c61569d7e76af5effd726b7ff6147961e5

SHA256
8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a

SHA512
8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\Qt5Core.dll
Filesize
5.7MB

MD5
817520432a42efa345b2d97f5c24510e

SHA1
fea7b9c61569d7e76af5effd726b7ff6147961e5

SHA256
8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a

SHA512
8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-console-l1-1-0.dll
Filesize
18KB

MD5
e5912b05988259dad0d6d04c8a17d19b

SHA1
724f4f91041ad595e365b724a0348c83acf12bbb

SHA256
9f3608c15c5de2f577a2220ce124b530825717d778f1e3941e536a3ab691f733

SHA512
c270a622d7887f4c97232ea898f5380459c565817f0d201cdb081ee82e3002b6e6248753a68da896d3b1327f93e8e8cb0ca0dcaeef324f610e0a1c7b542c6492

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-datetime-l1-1-0.dll
Filesize
18KB

MD5
16789cc09a417d7deb590fffe4ed02dc

SHA1
4940d5b92b6b80a40371f8df073bf3eb406f5658

SHA256
3b68d7ab0641de6b3e81d209b7c0d3896e4ffa76617bbadd01eb54036cdd1b07

SHA512
19e4f086cc2137ee60316b0736b3c6b3780578896df9a826edfe004bb74bee8e051c511a84d8a7ea278a5f47c82b9c955394f629ab0bb0740ecb51293d9be7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-debug-l1-1-0.dll
Filesize
18KB

MD5
9476affaac53e6e34405c4001f141805

SHA1
e7c8a6c29c3158f8b332eea5c33c3b1e044b5f73

SHA256
55574f9e80d313048c245acefd21801d0d6c908a8a5049b4c46253efaf420f89

SHA512
f8e3476a09d888caebd50da0ea2debc4006004e72af677919413655ab4595622cac524f1bc6c13406ee341ae0052a19ed83826ad530f652e73b2c65d4fa65680

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-errorhandling-l1-1-0.dll
Filesize
18KB

MD5
a5883c68d432f593812ab3b755b808db

SHA1
51cbb7ba47802dc630c2507750432c55f5979c27

SHA256
b3715112a7ca4c6cc0efee044bd82444d3267a379e33a3ec118d87e75604204d

SHA512
27153e29e99a905fa4c8b3ede078644a3a3f29fdf7b98e387e39c5c60444e326c92afd74da8fee225f7ddf39724a0daef68ba238f3cc64fb7860172b8f29d79a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-file-l1-1-0.dll
Filesize
21KB

MD5
241338aef5e2c18c80fb1db07aa8bcdf

SHA1
9acbeef0ac510c179b319ca69cd5378d0e70504d

SHA256
56de091efe467fe23cc989c1ee21f3249a1bdb2178b51511e3bd514df12c5ccb

SHA512
b9fd37f01a58594e48fa566c41827b2b9499605d9e55c2178e83ee41c8c5f50a4df2c85efea94ca586ea0ea4a6d984ebb7ca2193e9306fcb853b147b2c76bc2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-file-l1-2-0.dll
Filesize
18KB

MD5
49c3ffd47257dbcb67a6be9ee112ba7f

SHA1
04669214375b25e2dc8a3635484e6eeb206bc4eb

SHA256
322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

SHA512
bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-file-l2-1-0.dll
Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-handle-l1-1-0.dll
Filesize
18KB

MD5
cce27ff9b1e78b61955682788452f785

SHA1
a2e2a40cea25ea4fd64b8deaf4fbe4a2db94107a

SHA256
8ee2de377a045c52bbb05087ae3c2f95576edfb0c2767f40b13454f2d9f779de

SHA512
1fcec1cd70426e3895c48598dfc359839d2b3f2b1e3e94314872a866540353460ec932bf3841e5afe89aa4d6c6fac768e21ae368d68c2bb15f65960f6f5d7d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-heap-l1-1-0.dll
Filesize
18KB

MD5
cdc266896e0dbe6c73542f6dec19de23

SHA1
b4310929ccb82dd3c3a779cab68f1f9f368076f2

SHA256
87a5c5475e9c26fabfead6802dac8a62e2807e50e0d18c4bfadcb15ebf5bcbc0

SHA512
79a29041699f41938174a6ec9797faf8d6bf7764657d801cb3af15c225f8eab0135d59cfa627bd02dd7459f7b857d62299e4d082586ce690627ebdf1267ebb21

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-interlocked-l1-1-0.dll
Filesize
18KB

MD5
39809cc5dabf769da8871a91a8ed9e69

SHA1
f779cdef9ded19402aa72958085213d6671ca572

SHA256
5cd00ff4731691f81ff528c4b5a2e408548107efc22cc6576048b0fdce3dfbc9

SHA512
83a8246839d28378c6f6951d7593dc98b6caa6dbca5fbd023b00b3b1a9eba0597943838c508493533c2de276c4d2f9107d890e1c9a493ee834351cff5dfd2cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-libraryloader-l1-1-0.dll
Filesize
19KB

MD5
5d5fae1a17961d6ee37637f04fe99b8a

SHA1
47143a66b4a2e2ba019bf1fd07bcca9cfb8bb117

SHA256
8e01eb923fc453f927a7eca1c8aa5643e43b360c76b648088f51b31488970aa0

SHA512
9db32ec8416320dcb28f874b4679d2d47a5ae56317fdc9d2d65ebb553f1d6345c3dd0024294a671a694337683dd4e77254595a9cdbfe115c80d0ef53516d46aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-localization-l1-2-0.dll
Filesize
20KB

MD5
588bd2a8e0152e0918742c1a69038f1d

SHA1
9874398548891f6a08fc06437996f84eb7495783

SHA256
a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

SHA512
32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-memory-l1-1-0.dll
Filesize
18KB

MD5
6def20ed13972f3c3f08dba8ecf3d6cc

SHA1
9c03356cf48112563bb845479f40bf27b293e95e

SHA256
c2e887a17875d39099d662a42f58c120b9cc8a799afd87a9e49adf3faddd2b68

SHA512
5b4d2b1152bed14108dc58d358b1082e27defd1001d36cd72ec6f030a34d6caf9b01c3c1dd8a9ac66d1937fcf86a6fe3469ac93b1e76d933a8f4b51c1f782f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-namedpipe-l1-1-0.dll
Filesize
18KB

MD5
a056d4eeaae37deab8333dcc4c910a93

SHA1
cb59f1fe73c17446eb196fc0dd7d944a0cd9d81f

SHA256
593fa2aa2474508ad942bbaa0fdc9a1badd81c85b0dff1c43b90a47c23ad5fb7

SHA512
c2f811994182ef51d0c011c19336179da69357e5f284f787bcdb54f90c32768a959232a477534f7e62cd3d71a048a13e91b20042e2fe6ab108d606c7c8df9255

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-processenvironment-l1-1-0.dll
Filesize
19KB

MD5
f3b4ab35a65a8d938c6b60ad59ba6e7f

SHA1
2745259f4dbbefbf6b570ee36d224abdb18719bc

SHA256
ea2972fec12305825162ae3e1ae2b6c140e840be0e7ebb51a7a77b7feeda133a

SHA512
a88afb66311494d6c15613c94555ba436cd2f75e11a49a448c9c6776dfba24cda25a44792a1e8b3e680c1ad3ad0574b43ac2328c6e41ff0832139c94b066dbf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-processthreads-l1-1-0.dll
Filesize
20KB

MD5
5faf9a33bab1d39dd9f820d34339b3d4

SHA1
50699041060d14576ed7bacbd44be9af80eb902a

SHA256
a1221836731c7e52c42d5809cc02b17c5ec964601631ec15a84201f423da4ac4

SHA512
73c25d1338df9aee5211fbb0e1b14e6bd853e31746c63bc46f44810622b09d52ee39b8e8a57c655da63d3d3d4025c2cba4d8673893d022417a2032ba3d935061

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
18KB

MD5
d699333637db92d319661286df7cc39e

SHA1
0bffb9ed366853e7019452644d26e8e8f236241b

SHA256
fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

SHA512
6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-profile-l1-1-0.dll
Filesize
17KB

MD5
7028cf6b6b609cb0e31abd1f618e42d0

SHA1
e7e0b18a40a35bd8b0766ac72253de827432e148

SHA256
9e98b03a3ca1ebabdceb7ed9c0ceb4912bb68eb68f3e0df17f39c7a55fada31d

SHA512
d035ccfd0de316e64187c18e6e5b36e14f615f872c08740ec22ef2c12d592e37d78ab154202926a56ab01d669eb5870dff651280a882d6bf2a700c43dcd25ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-rtlsupport-l1-1-0.dll
Filesize
18KB

MD5
2166fb99debbb1b0649c4685cf630a4a

SHA1
24f37d46dfc0ef303ef04abf9956241af55d25c9

SHA256
cdc4cfebf9cba85b0d3979befdb258c1f2cfcb79edd00da2dfbf389d080e4379

SHA512
de27d06b1f306110b42d0ed2642a555862d0ade7e56e5f2908e399f140aa5f43904e08d690bcb0d2f4d11d799ec18fa682db048da57d99cd99891e45add86371

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-string-l1-1-0.dll
Filesize
18KB

MD5
b7cbc8d977a00a2574e110b01124ed40

SHA1
637e4a9946691f76e6deb69bdc21c210921d6f07

SHA256
854db7d2085caacf83d6616761d8bdcbacb54a06c9a9b171b1c1a15e7dc10908

SHA512
b415ef4092fa62d39941bf529a2032bc8b591c54ed2050ea4730f198899f147539b2c0e97f3c4f14848c71066924c1848ae5f07779a1a47ab4c5e46f02be7258

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-synch-l1-1-0.dll
Filesize
20KB

MD5
6961bf5622ffcd14c16fbfc1296950a4

SHA1
5584c189216a17228cca6cd07037aaa9a8603241

SHA256
50a1542d16b42ecb3edc1edd0881744171ea52f7155e5269ad39234f0ea691de

SHA512
a4d0c15acbff4e9140ae4264fa24bd4c65fb2d1052a0b37bf281498f3b641fef563c18115511829a23340c9440f547028d36015ba38cbd51ad0744d44d5ccd87

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-synch-l1-2-0.dll
Filesize
18KB

MD5
47388f3966e732706054fe3d530ed0dc

SHA1
a9aebbbb73b7b846b051325d7572f2398f5986ee

SHA256
59c14541107f5f2b94bbf8686efee862d20114bcc9828d279de7bf664d721132

SHA512
cce1fc5bcf0951b6a76d456249997b427735e874b650e5b50b3d278621bf99e39c4fc7fee081330f20762f797be1b1c048cb057967ec7699c9546657b3e248ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-sysinfo-l1-1-0.dll
Filesize
19KB

MD5
df50047bbd2cf3a4b0cf0567514b464c

SHA1
f20ae25484a1c1b43748a1f0c422f48f092ad2c1

SHA256
8310d855398f83cb5b9ca3adeb358da1354557aec5c82c8ef91a29f79a47f620

SHA512
5c3bfc2ccb2ee864b99f6709677474327e85889f4c962ea0a1ef9e1e876dc88b1d8e8e0f6c1422f634ff1c84a861c34e52ee07dac7fdde505b508bea80562b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-timezone-l1-1-0.dll
Filesize
18KB

MD5
f62b66f451f2daa8410ad62d453fa0a2

SHA1
4bf13db65943e708690d6256d7ddd421cc1cc72b

SHA256
48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

SHA512
d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-core-util-l1-1-0.dll
Filesize
18KB

MD5
a1952875628359a0632be61ba4727684

SHA1
1e1a5ab47e4c2b3c32c81690b94954b7612bb493

SHA256
a41bede183fa1c70318332d6bc54ef13817aeee6d52b3ab408f95fa532b809f1

SHA512
3f86180cc085dc8c9f6d3c72f5ccc0f5a0c9048343edaf62239eb4b038799845388898408ed7e8eac5d015a9bc42ff428f74585f64f5d3467dddb1303baf4f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-conio-l1-1-0.dll
Filesize
19KB

MD5
6c88d0006cf852f2d8462dfa4e9ca8d1

SHA1
49002b58cb0df2ee8d868dec335133cf225657df

SHA256
d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663

SHA512
d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-convert-l1-1-0.dll
Filesize
22KB

MD5
d53637eab49fe1fe1bd45d12f8e69c1f

SHA1
c84e41fdcc4ca89a76ae683cb390a9b86500d3ca

SHA256
83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087

SHA512
94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-environment-l1-1-0.dll
Filesize
18KB

MD5
c712515d052a385991d30b9c6afc767f

SHA1
9a4818897251cacb7fe1c6fe1be3e854985186ad

SHA256
f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1

SHA512
b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-filesystem-l1-1-0.dll
Filesize
20KB

MD5
f0d507de92851a8c0404ac78c383c5cd

SHA1
78fa03c89ea12ff93fa499c38673039cc2d55d40

SHA256
610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27

SHA512
a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-heap-l1-1-0.dll
Filesize
19KB

MD5
f9e20dd3b07766307fccf463ab26e3ca

SHA1
60b4cf246c5f414fc1cd12f506c41a1043d473ee

SHA256
af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a

SHA512
13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-locale-l1-1-0.dll
Filesize
18KB

MD5
ab206f2943977256ca3a59e5961e3a4f

SHA1
9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e

SHA256
b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a

SHA512
baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-math-l1-1-0.dll
Filesize
27KB

MD5
4dd7a61590d07500704e7e775255cb00

SHA1
8b35ec4676bd96c2c4508dc5f98ca471b22deed7

SHA256
a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499

SHA512
1086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-multibyte-l1-1-0.dll
Filesize
26KB

MD5
4e033cfee32edf6be7847e80a5114894

SHA1
91eef52c557aefd0fde27e8df4e3c3b7f99862f2

SHA256
dff24441df89a02dde1cd984e4d3820845bafdff105458ed10d510126117115b

SHA512
e1f3d98959d68ef3d7e86ac4cb3dbdf92a34fcfd1bf0e0db45db66c65af0162ab02926dc5d98c6fc4a759a6010026ee26a9021c67c0190da941a04b783055318

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-private-l1-1-0.dll
Filesize
69KB

MD5
50740f0bc326f0637c4166698298d218

SHA1
0c33cfe40edd278a692c2e73e941184fd24286d9

SHA256
adbb658dd1cbecaca7cc1322b51976f30b36ccf0a751f3bad1f29d350b192c9c

SHA512
f1331ab1d52fb681f51546168e9736e2f6163e0706955e85ac9e4544d575d50e6eacd90ea3e49cb8b69da34fe0b621b04661f0b6f09f7ce8ceca50308c263d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-process-l1-1-0.dll
Filesize
19KB

MD5
595d79870970565be93db076afbe73b5

SHA1
ec96f7beeaec14d3b6c437b97b4a18a365534b9b

SHA256
fc50a37acc35345c99344042d7212a4ae88aa52a894cda3dcb9f6db46d852558

SHA512
152849840a584737858fc5e15f0d7802786e823a13ec5a9fc30ee032c7681deaf11c93a8cffead82dc5f73f0cd6f517f1e83b56d61d0e770cbb20e1cfff22840

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-runtime-l1-1-0.dll
Filesize
22KB

MD5
8b9b0d1c8b0e9d4b576d42c66980977a

SHA1
a19acefa3f95d1b565650fdbc40ef98c793358e9

SHA256
371a44ab91614a8c26d159beb872a7b43f569cb5fac8ada99ace98f264a3b503

SHA512
4b1c5730a17118b7065fada3b36944fe4e0260f77676b84453ee5042f6f952a51fd99debca835066a6d5a61ba1c5e17247551340dd02d777a44bc1cae84e6b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-stdio-l1-1-0.dll
Filesize
24KB

MD5
76e0a89c91a28cf7657779d998e679e5

SHA1
982b5da1c1f5b9d74af6243885bcba605d54df8c

SHA256
0189cbd84dea035763a7e52225e0f1a7dcec402734885413add324bffe688577

SHA512
d75d8798ea3c23b3998e8c3f19d0243a0c3a3262cffd8bcee0f0f0b75f0e990c9ce6644150d458e5702a8aa51b202734f7a9161e795f8121f061139ad2ea454f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-string-l1-1-0.dll
Filesize
24KB

MD5
96da689947c6e215a009b9c1eca5aec2

SHA1
7f389e6f2d6e5beb2a3baf622a0c0ea24bc4de60

SHA256
885309eb86dccd8e234ba05e13fe0bf59ab3db388ebfbf6b4fd6162d8e287e82

SHA512
8e86fa66a939ff3274c2147463899df575030a575c8f01573c554b760a53b339127d0d967c8cf1d315428e16e470fa1cc9c2150bb40e9b980d4ebf32e226ee89

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-time-l1-1-0.dll
Filesize
20KB

MD5
6b33b34888ccecca636971fbea5e3de0

SHA1
ee815a158baacb357d9e074c0755b6f6c286b625

SHA256
00ac02d39b7b16406850e02ca4a6101f45d6f7b4397cc9e069f2ce800b8500b9

SHA512
f52a2141f34f93b45b90eb3bbcdb64871741f2bd5fed22eaaf35e90661e8a59eba7878524e30646206fc73920a188c070a38da9245e888c52d25e36980b35165

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\api-ms-win-crt-utility-l1-1-0.dll
Filesize
18KB

MD5
54f27114eb0fda1588362bb6b5567979

SHA1
eaa07829d012206ac55fb1af5cc6a35f341d22be

SHA256
984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1

SHA512
18d2bdce558655f2088918241efdf9297dfe4a14a5d8d9c5be539334ae26a933b35543c9071cedada5a1bb7c2b20238e9d012e64eb5bbf24d0f6b0b726c0329d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\concrt140.dll
Filesize
302KB

MD5
046f9be1a19af1ed07d89f36c105ce30

SHA1
e042dcf12df1145e9ef9f7d562f17a0df2000201

SHA256
449e6073300d973d3d07f08896140ecdcc1c7fe8f58cff5aa7096cc124cf6393

SHA512
2f123bf754e00af68e054c3b41a0fb9f8f53a255daef2144d337020b0d299ae9466ca5d7d1b249ce039e69e762d4ed4b4a13e968ef182223486ae3801b559de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\msvcp140.dll
Filesize
569KB

MD5
06ceae72572cf5ae8beb4e9fc8c30c3c

SHA1
cfe1f8f4116ebda81a097af6ca7eaa26fd206953

SHA256
959c2be421bb7f1c71690cfb4fbc98ab63b63a58a50b458383f89b6ba5c1143a

SHA512
24befa9504e649ebef19b1413c41b5a2beee9e83d89ae84fdbf2a0126b3c023d439a60b828918398407109adaed1c6fd59621e8cb65e9017d98b4eccc1d1eea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\msvcp140_1.dll
Filesize
23KB

MD5
e3ff74444c7f1eee64698b71432dfe1f

SHA1
2859dfd852b72f9f48a355663586e59eed283525

SHA256
bcea68627d9e9ec0dfa3602a94cdc8bb615134a57e11beda5a5593ba54b3301a

SHA512
777020de33c3c21c16ae3b036bef01ab5dacd32b8419819a3532cae10fb7c0c760e666c0975aa366ce78a9cfba8ae3f9dc884726516aa88eb92dc171f125b5c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\msvcp140_2.dll
Filesize
181KB

MD5
dd3357834997fc5cc2bfe816c8535227

SHA1
09b41fd5b31034f401eac39c5eaf5972f6c3bf51

SHA256
5eb61fff563318c21f14aa1226b1d9b7a1f4f5344869bddd233b6bd8f99d1272

SHA512
4c5aef1b766bcae23248b87f6dd422f5c41069d65e8a4027bed40fc41a13be853d5503893266c962db73c241337d8161dd39ab3ab3f7a83512f31e2cff1dee66

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\msvcp140_codecvt_ids.dll
Filesize
19KB

MD5
677f6585b526b4ee9bf44310054fc909

SHA1
df3d495d94cc7fa77e3cc57b0627b331ed24a14b

SHA256
cb9c5eb47d68528bfc42a912eb5b99266a29f32f5dd57cb44d9a3b8017f86599

SHA512
80201235657e89cb9ebc002defa00ae0936dcc777477938dbf0dde069e45c4188d74f1ce96f3ed42726d326686061e24b234600a7b26a8fb9d937ef9218f9625

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\InstallerGui.exe
Filesize
19.0MB

MD5
c2189029154d736788ecb194dd29d6d9

SHA1
0bfaaeb5e31d98263e58e872f5cd16c725320ee5

SHA256
9e9cd4742c2122297c72a0099c88a8108bf5a6cc45bb4e2375d1a98103933ac6

SHA512
35c0fb50781825850facc1a2eadc75e4f4143778e397017d4aca41f8cb217d2940dc6d99faaa5d4c9dc47cf3d186e3b6f5506f09bc4d9de8604b7f3f054b2ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\InstallerGui.exe
Filesize
19.0MB

MD5
c2189029154d736788ecb194dd29d6d9

SHA1
0bfaaeb5e31d98263e58e872f5cd16c725320ee5

SHA256
9e9cd4742c2122297c72a0099c88a8108bf5a6cc45bb4e2375d1a98103933ac6

SHA512
35c0fb50781825850facc1a2eadc75e4f4143778e397017d4aca41f8cb217d2940dc6d99faaa5d4c9dc47cf3d186e3b6f5506f09bc4d9de8604b7f3f054b2ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\Qt5WebEngine.dll
Filesize
371KB

MD5
1d783ecdbe2cd530d2102b0a14f026e1

SHA1
f31e673064894a8bda963e1ebadd1bc96116525a

SHA256
c1ef45ae2a37d8882e8b6aced719e3ebe058ccf45f86a917c5bc726646cc732c

SHA512
feaab31dce3df93b2d83608c7615d406b82110260a1779e63f9a87423d91824ab8b4067f9eee68cf8cce3f32ba797e6846793d81d7074539a756b0b28b81852b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\Qt5Widgets.dll
Filesize
5.2MB

MD5
4cd1f8fdcd617932db131c3688845ea8

SHA1
b090ed884b07d2d98747141aefd25590b8b254f9

SHA256
3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358

SHA512
7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\qt-dependencies\Qt5Widgets.dll
Filesize
5.2MB

MD5
4cd1f8fdcd617932db131c3688845ea8

SHA1
b090ed884b07d2d98747141aefd25590b8b254f9

SHA256
3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358

SHA512
7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\quazip1-qt5.dll
Filesize
270KB

MD5
1a5805e26d42789f5d3e53778445326e

SHA1
29e8649bfa623461c011096fef802e626bbcc382

SHA256
23092e585cc8bb0ea21b19e3f4c2caa9219bf153c6d34d550e903debaaa3567e

SHA512
7f120b4d3434ed359c6b3b793cce53c666a7acc5bee3b62b883733c0a19eb3bebf21c029bf985f736154dd390986cfe157ce1f46137a38a23d7c5c1968990f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\quazip1-qt5.dll
Filesize
270KB

MD5
1a5805e26d42789f5d3e53778445326e

SHA1
29e8649bfa623461c011096fef802e626bbcc382

SHA256
23092e585cc8bb0ea21b19e3f4c2caa9219bf153c6d34d550e903debaaa3567e

SHA512
7f120b4d3434ed359c6b3b793cce53c666a7acc5bee3b62b883733c0a19eb3bebf21c029bf985f736154dd390986cfe157ce1f46137a38a23d7c5c1968990f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\setup_ui_dep.zip
Filesize
103.2MB

MD5
26ea60b2d5d8b04d59be8bb8c76574b0

SHA1
d9767c690b5492e10d2431443f21f0532ba09910

SHA256
a46ff463210ba2cd0f5ccaf5aa13696d27d21b5b4a50792060643c0a4be2e911

SHA512
141d92a101e7f7b5c1a8f9b33d82f2dce9bec174e44925a3203227acb30b7d0fa2efb202e753c7d27d9d8e0a1ce9b83c7255228da0e434ef7a065725f3a57672

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\ucrtbase.dll
Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\vccorlib140.dll
Filesize
322KB

MD5
5cf23f72a27ba74852cd55980469d68d

SHA1
fea39f64afc687a47b3e0fb9f8831eff16a35b87

SHA256
5aff6efe80668d263eecdf1e2ae98f08ca7161c3053eae514cd64a7118b902d8

SHA512
f9f8f59fbe4fc38883305cfe064c4b83b5b9896ad4927ab5887b8584e004fba83c3bd9bfc0aed4a6c2d0a37f381ecf0138b7abfdf1f92ceae172db4f11d3da62

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\vcruntime140.dll
Filesize
91KB

MD5
6a6ff61f089628002171eed4ac6900a4

SHA1
dc6679bac5b36356f6d294f00ee44dddb1ce9108

SHA256
2aa86a67ce51fba3fbf3d90635332fff61d505e8b9150ad56c98232b3672ae86

SHA512
a1386022d13b2631132a0376ed61ca94c168547f61250289e6845edea5e49a7af51c669698b13399a69a086ab2081d87ff8999668b4ca7b6c5134eeeebdcfb38

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\vcruntime140_1.dll
Filesize
35KB

MD5
be3101d186603f94c84e8d67c65e4682

SHA1
0a0cabe372657d8a633c764050cc8206e29da0e4

SHA256
a1e752b2e2e2d69f29892371a47ad50a56fddf978d8ee09959cebe9780441603

SHA512
0cb1d6a05e40c90b36428f7c9c6d83230675e01921a31361e18265981f04a20cc9e838dd2f3c0759b8bb217203415ea43a9aadf0eda5333ab42716aeb2c44494

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\zlib.dll
Filesize
131KB

MD5
eaa9f0f3b8fac95673be9ba9c1443829

SHA1
71330455589b3e7a7bf63c4005c0c78edab19f1f

SHA256
3a4f58e515dafef80074588e43d4fe8c51e90495d7169dd2ff7fb995fcdce9e7

SHA512
f975c75ddd4c06c92f0be124c27bfa70d53d6b0df282044067229d6531b9365ccb21d8f500c8806d8799a22840b18656f1962c60f5989c4feacd4164565d1a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5137\zlib.dll
Filesize
131KB

MD5
eaa9f0f3b8fac95673be9ba9c1443829

SHA1
71330455589b3e7a7bf63c4005c0c78edab19f1f

SHA256
3a4f58e515dafef80074588e43d4fe8c51e90495d7169dd2ff7fb995fcdce9e7

SHA512
f975c75ddd4c06c92f0be124c27bfa70d53d6b0df282044067229d6531b9365ccb21d8f500c8806d8799a22840b18656f1962c60f5989c4feacd4164565d1a32

Download Submit
memory/812-259-0x0000000000000000-mapping.dmp

Download
memory/812-261-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/812-262-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/1336-169-0x000001BFA32CD000-0x000001BFA32D0000-memory.dmp

Filesize
12KB

Download
memory/1336-174-0x000001BFA3325000-0x000001BFA3328000-memory.dmp

Filesize
12KB

Download
memory/1336-161-0x000001BFA32C9000-0x000001BFA32CD000-memory.dmp

Filesize
16KB

Download
memory/1336-162-0x000001BFA32C9000-0x000001BFA32CD000-memory.dmp

Filesize
16KB

Download
memory/1336-195-0x000001BFA332A000-0x000001BFA332D000-memory.dmp

Filesize
12KB

Download
memory/1336-143-0x000001BFB3500000-0x000001BFB3600000-memory.dmp

Filesize
1024KB

Download
memory/1336-142-0x000001BFA14C8000-0x000001BFA14D0000-memory.dmp

Filesize
32KB

Download
memory/1336-163-0x000001BFA32C9000-0x000001BFA32CD000-memory.dmp

Filesize
16KB

Download
memory/1336-164-0x000001BFA32C9000-0x000001BFA32CD000-memory.dmp

Filesize
16KB

Download
memory/1336-160-0x000001BFA32C9000-0x000001BFA32CD000-memory.dmp

Filesize
16KB

Download
memory/1336-168-0x000001BFA32CD000-0x000001BFA32D0000-memory.dmp

Filesize
12KB

Download
memory/1336-175-0x000001BFA3325000-0x000001BFA3328000-memory.dmp

Filesize
12KB

Download
memory/1336-167-0x000001BFA32CD000-0x000001BFA32D0000-memory.dmp

Filesize
12KB

Download
memory/1336-166-0x000001BFA32CD000-0x000001BFA32D0000-memory.dmp

Filesize
12KB

Download
memory/1336-173-0x000001BFA3325000-0x000001BFA3328000-memory.dmp

Filesize
12KB

Download
memory/1336-141-0x000001BFA27E0000-0x000001BFA2800000-memory.dmp

Filesize
128KB

Download
memory/1336-190-0x000001BFA332A000-0x000001BFA332D000-memory.dmp

Filesize
12KB

Download
memory/1336-196-0x000001BFA332A000-0x000001BFA332D000-memory.dmp

Filesize
12KB

Download
memory/3784-148-0x0000000000000000-mapping.dmp

Download
memory/4556-254-0x0000000000000000-mapping.dmp

Download
memory/4556-260-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/4556-258-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/5200-240-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/5200-239-0x00007FFB10760000-0x00007FFB10CA1000-memory.dmp

Filesize
5.3MB

Download
memory/5200-247-0x00000298CD010000-0x00000298CD020000-memory.dmp

Filesize
64KB

Download
memory/5200-232-0x0000000000000000-mapping.dmp

Download
memory/5200-238-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/5200-242-0x00000298CD010000-0x00000298CD020000-memory.dmp

Filesize
64KB

Download
memory/5200-245-0x00000298D2590000-0x00000298D2790000-memory.dmp

Filesize
2.0MB

Download
memory/5200-243-0x00000298D1A90000-0x00000298D1ED0000-memory.dmp

Filesize
4.2MB

Download
memory/5568-241-0x0000000000000000-mapping.dmp

Download
memory/5724-251-0x0000000000000000-mapping.dmp

Download
memory/5724-257-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/5724-255-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/5864-252-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/5864-250-0x00007FFB0E550000-0x00007FFB0E948000-memory.dmp

Filesize
4.0MB

Download
memory/5864-248-0x0000000000000000-mapping.dmp

Download
memory/5984-263-0x0000000000000000-mapping.dmp

Download