arrowrat | 76a23c2c0f53fd0360b8eb6b6204a46f011a59a4b9e66adc1507da50f8a45c38

Analysis

max time kernel
174s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2022, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8573d9e75f2c0ef4e69023fc07bee9cb.exe
Size

91KB
MD5

8573d9e75f2c0ef4e69023fc07bee9cb
SHA1

4f3afbab31505056fd71f462bd52f98f3dd9f8ff
SHA256

e5d590f782337416fe7f93aa7f488419f86802500d05ef2fced4ccca7f4e14ae
SHA512

11bbaa8c41989d583ca1af59d8c51b80825634807dfcd8fc50f5e8d3190d224ca48139f70e10a2993b9ae1bca599ee0dd1422af5c716f5441c533c1dedef72e7
SSDEEP

1536:dbRiQM/57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33B:dbRE57SKsstcnZTJQDgWPaySsdH5x

Score

10^/10

arrowrat ty persistence ransomware rat

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{4e498bc7-105a-4838-9874-dcd808cf5910}\0.0.filtertrie.intermediate.txt

Ransom Note

0 0 ~ zoom~ zooming when you pinch with two fingers on the touchpad~ zoom mode~ zoom level~ zoom lens size~ zoom lens settings~ zoom in~ zoom increment~ zoom in:wux:zoom in~ zoom behavior~ zoom amount~ zone~ zones~ zone automatically~ ypdate~ your work or school~ your work or school domain~ your work or school cloud domain~ your windows mixed reality headset goes to sleep~ your wheel~ your voice~ your voice to improve speech services~ your voice to control your pc~ your videos library~ your update history~ your touchpad~ your touchpad to its default settings~ your timeline~ your sound output device~ your sound input device~ your settings~ your restart~ your recovery key~ your quick actions~ your profile~ your product id~ your picture~ your pictures library~ your phone~ your phone to timeline~ your personalization settings~ your pen's pressure sensitivity~ your pen shortcuts~ your pen settings~ your pc~ your pc recognizes your handwriting~ your pc name~ your pc and help you, or offer to help someone else~ your password~ your passwords on this pc~ your organization to manage your pc~ your offline files~ your notifications~ your network properties~ your network adapter~ your mouse~ your mouse to the end of the taskbar~ your mouse settings~ your microphone~ your lock screen background~ your language list~ your language and keyboard settings~ your info~ your homepage~ your hololens~ your headset sleeps~ your handwriting~ your fingertip~ your files with file history~ your eye tracker~ your email~ your drives~ your documents library~ your diagnostic data~ your device~ your device to your work or school domain~ your device to your work or school cloud domain~ your device password-less~ your device history~ your device from your work or school~ your device easier to hear~ your desktop background~ your country or region~ your cortana devices~ your contacts~ your computer~ your computer's status and resolve issues~ your computer's power settings~ your computer's memory problems~ your computer name~ your computer is on~ your cellular data connection with other devices~ your camera~ your call history~ your calendar~ your button flows as quick actions~ your braille display~ your advertising id~ your account~ your account picture~ your account info~ your accent color~ you, or offer to help someone else~ you use windows~ you use three finger taps on the touchpad~ you use the touchpad~ you use the mouse~ you use four finger taps on the touchpad~ you type~ you touch the screen~ you to enter tablet mode~ you tap with two fingers on the touchpad~ you store offline maps~ you speak with your device~ you sign in~ you send to microsoft~ you scroll with the mouse wheel~ you pinch with two fingers on the touchpad~ you open links~ you move your mouse to the end of the taskbar~ you have a 32-bit or 64-bit version of windows~ you drag with two fingers on the touchpad~ you drag three fingers on the touchpad~ you drag four fingers on the touchpad~ you double-tap the spacebar~ you double-tap shift~ you choose a text suggestion~ you can always say "hey cortana"~ you are right or left handed~ xdevice settings~ xbox performance~ xbox one settings~ xbox one controller settings~ xbox networking~ xbox networking settings~ xbox multiplayer settings~ xbox live~ xbox game bar~ x-device settings~ x menu~ wwin~ wwindows~ wwan~ wupdate~ wupdater~ wudo~ wuapp~ wsr~ writing~ write~ write in the handwriting panel with your fingertip~ workspace~ workspace when i remove my pen from storage~ workspace settings~ workplace settings~ workplace policies~ workplace network~ workplace access~ workgroup this computer is on~ workgroup name~ workflow~ work users~ work settings~ work remotely~ work or school~ work or school users~ work or school domain~ work or school cloud domain~ work network~ work hours~ work folders~ work email~ work account~ words~ words as you type~ words as i type~ word echo~ wondows~ wndows~ wndows update~ wlan~ wlan settings~ without sound~ without signing~ with your network adapter~ with your fingertip~ with your device~ with your computer~ with your computer's power settings~ with windows update~ with windows store apps~ with windows search~ with windows powershell in the win + x menu~ with windows mixed reality~ with windows firewall~ with two fingers on the touchpad~ with the touch keyboard~ with the screen when using the mouse~ with the mouse wheel~ with speech~ with shared folders~ with recording sound~ with quickstart~ with printing~ with playing sound~ with playing movies, tv shows, or videos~ with other devices~ with narrator~ with file history~ with directaccess~ with bluetooth devices~ with background downloads~ wireless~ wireless:wux:wireless~ wireless settings~ wireless display~ wireless display settings~ wireless devices on or off~ wireless controller settings~ wireless adapter problems~ wireless adapter issues~ wipe:wux:wipe~ winupdate~ winsows~ winows~ winows update~ winodws~ winodws update~ winf~ windws~ windws update~ windwos update~ windpws~ window~ windowupdate~ windows~ windowsupdate~ windowsupdates~ windows y~ windows x~ windows when i hover over them~ windows welcome notifications~ windows vpn~ windows version~ windows version:wux:windows version~ windows ups~ windows upo~ windows upgrade~ windows updte~ windows updatw~ windows updats~ windows updatre~ windows update~ windows updates~ windows updates:wux:windows updates~ windows updater~ windows updater:wux:windows updater~ windows updated~ windows update troubleshooter~ windows update settings~ windows update settings:wux:windows update settings~ windows update restart settings~ windows update problems~ windows update policies~ windows update options~ windows update not working~ windows update issues~ windows update history~ windows update delivery settings~ windows update delivery optimization~ windows update broken~ windows updare~ windows updae~ windows updaet~ windows upate~ windows upadte~ windows uop~ windows uodate~ windows uip~ windows udpate~ windows udate~ windows u[~ windows track app launches to improve start and search results~ windows to the sides or corners of the screen~ windows to go startup options~ windows to fill available space~ windows system:wux:windows system~ windows sync activities from this pc to the cloud~ windows suggest ease of access settings~ windows subscription~ windows store apps~ windows spotlight~ windows speech recognition~ windows specifications~ windows sonic~ windows show on the taskbar when using virtual desktops~ windows settings~ windows security settings~ windows search~ windows searches~ windows search:wux:windows search~ windows search settings~ windows s mode settings~ windows restore:wux:windows restore~ windows repair:wux:windows repair~ windows recovery:wux:windows recovery~ windows privacy~ windows powershell in the win + x menu~ windows permissions~ windows pdate~ windows password~ windows online personalization gallery~ windows on taskbar on secondary displays~ windows on taskbar on primary display~ windows mr settings~ windows mobility center~ windows mixed reality~ windows mixed reality settings~ windows mixed reality headset goes to sleep~ windows mixed reality audio settings~ windows manage my default printer~ windows logo key + c~ windows license~ windows is activated~ windows insider settings~ windows insider program settings~ windows ink workspace settings~ windows ink settings~ windows information:wux:windows information~ windows indexer~ windows hello~ windows hello:wux:windows hello~ windows hello setup~ windows hello settings~ windows hello pin~ windows hello fingerprint~ windows hello face~ windows hd color settings~ windows firewall~ windows firewall with advanced security~ windows firewall troubleshooter~ windows fire wall~ windows feedback frequency~ windows features on or off~ windows features appear in~ windows edition~ windows display language~ windows disk management~ windows diagnostics~ windows device manager~ windows defender~ windows defender firewall~ windows credentials~ windows credential manager~ windows collect activities from this pc~ windows cant hear me~ windows can't hear me~ windows backup:wux:windows backup~ windows background images~ windows anywhere settings~ windows animation~ windows and tabs appear when pressing alt+tab~ windows activation~ windows activation settings~ windows activate~ windows 8~ windows 8.1~ windows 7~ windows 64~ windows 32~ windows 10 update~ windows 10 updates:wux:windows 10 updates~ windows 10 restarts~ windows + x~ windown~ windowing~ windowes~ windowa update~ window, show what i can snap next to it~ window, resize any adjacent snapped window~ window version:wux:window version~ window update~ window updates~ window transparency~ window sup~ window supdate~ window layout~ window firewall~ window fill~ window features~ window de~ window color~ window arrangement~ windos update~ windoq~ windopws~ windoiws~ windoews~ windoes~ windoes update~ windiws~ windd~ winddows~ wind up~ win-x~ win-v~ win-c~ win+x~ win+v~ win+g~ win+c~ win x~ win update~ win updates~ win plus x~ win plus c~ win c~ win - x~ win - v~ win - c~ win + x menu~ win + v~ win + c~ wimd~ wimdows~ wiin~ wiindows~ wifi~ wifi settings~ width~ widows update~ widnows update~ wider cursor~ wider caret~ wide cursor~ wide caret~ wi-fi~ wi-fi:wux:wi-fi~ wi-fi settings~ wi-fi networks~ wi fi~ why an action can't be performed~ white theme~ white pointer~ white mouse pointer~ white mouse cursor~ white cursor~ while roaming~ while focus assist was on~ which workgroup this computer is on~ which icons appear on the taskbar~ which folders appear on start~ which files and folders are indexed~ which domain your computer is on~ which apps show notifications~ which apps should not be included in sets~ which apps can run in the background~ which apps can make phone calls~ which apps can control radios~ which apps can access your videos library~ which apps can access your pictures library~ which apps can access your notifications~ which apps can access your microphone~ which apps can access your eye tracker~ which apps can access your email~ which apps can access your documents library~ which apps can access your contacts~ which apps can access your camera~ which apps can access your call history~ which apps can access your calendar~ which apps can access your account info~ which apps can access diagnostic information~ which accounts appear in your timeline~ whether you are right or left handed~ whether to have a touchpad delay~ whether to enter tablet mode when you sign in~ whether the system asks you to enter tablet mode~ where you store offline maps~ where to install apps from~ where is the product key~ when your windows mixed reality headset goes to sleep~ when your headset sleeps~ when you use three finger taps on the touchpad~ when you use the touchpad~ when you use the mouse~ when you use four finger taps on the touchpad~ when you touch the screen~ when you tap with two fingers on the touchpad~ when you sign in~ when you pinch with two fingers on the touchpad~ when you move your mouse to the end of the taskbar~ when you drag with two fingers on the touchpad~ when you drag three fingers on the touchpad~ when you drag four fingers on the touchpad~ when you double-tap the spacebar~ when you double-tap shift~ when you choose a text suggestion~ when using virtual desktops~ when using the touchpad~ when using the mouse~ when using repeat keys~ when using captures~ when typing~ when two keys are pressed at the same time~ when turning on sticky, toggle, or filter keys~ when to turn off the screen~ when to turn off the screen when plugged in~ when to turn off the screen on battery power~ when the sticky keys modifier key is pressed~ when the screen is turned off~ when the pc sleeps~ when the pc sleeps when plugged in~ when the pc sleeps on battery power~ when pressing caps lock, num lock, or scroll lock~ when pressing alt+tab~ when possible~ when plugged in~ when pcs try to connect to my mobile device using usb~ when on battery~ when num lock is on~ when navigating~ when narrator is speaking~ when narrator is on~ when my device is locked~ when lighting changes~ when launching an app from another app~ when keys are pressed~ when i’m using my pen~ when it’s available~ when it's pressed twice in a row~ when it's moving~ when i turn on narrator~ when i snap a window, show what i can snap next to it~ when i resize a snapped window, resize any adjacent snapped window~ when i remove my pen from storage~ when i record~ when i record a game~ when i hover over them~ when enabling sticky keys, toggle keys, or filter keys~ when duplicating screen~ when closing tabs~ when apps access my location~ when a mouse is connected~ wheel~ wheels~ wheel vibration settings~ wheel vibrate~ wheel settings~ wheel haptics settings~ wheel defaults~ wheel default settings~ whats new~ what's new~ what windows show on the taskbar when using virtual desktops~ what windows and tabs appear when pressing alt+tab~ what version of windows do i have:wux:what version of windows do i have~ what is my computer name:wux:what is my computer name~ what i missed while focus assist was on~ what i can snap next to it~ what happens when you use three finger taps on the touchpad~ what happens when you use four finger taps on the touchpad~ what happens when you drag three fingers on the touchpad~ what happens when you drag four fingers on the touchpad~ what cortana can do, see, and use~ what closing the lid does~ what appears when pressing alt+tab~ what appears when launching an app from another app~ wfi~ well your pc recognizes your handwriting~ welcome screen~ welcome screen settings~ welcome notifications~ website~ websites~ websites can use your language list~ website apps~ weblinks~ webcame~ webcam:wux:webcam~ webcam settings~ webcam privacy~ webcam permissions~ web to app link~ web to app linking~ web pages are displayed in tabs~ web links~ web language~ web languages~ web credentials~ web content control~ web cam:wux:web cam~ web browser~ web browsers~ web browser settings~ web apps~ ways i can set up my device to get the most out of windows~ way measurements are displayed~ way currency is displayed~ was on~ warn~ warning~ warnings~ wallpaper~ wallpaper sync~ wallpaper settings~ wait for second keystroke~ wait for repeated keystrokes~ wait for new keystrokes~ wait for keystrokes~ wait for different keystrokes~ wait before accepting keystrokes~ w up~ vpnm~ vpn while roaming~ vpn settings~ vpn over metered networks~ vpn options~ vpn connection~ vpn advanced settings~ vpn advanced options~ vpmn~ volume~ volume settings~ volume of other apps when narrator is speaking~ volume mixer~ volume mixer:wux:volume mixer~ volume level~ volume control~ voice~ voices~ voiceover~ voice volume~ voice tone~ voice to improve speech services~ voice to control your pc~ voice timbre~ voice timber~ voice speed~ voice settings~ voice rate~ voice quality~ voice pitch~ voice for apps~ voice emphasize formatted text~ voice dictation~ voice data~ voice control~ voice agents~ voice agent settings~ voice activation settings~ voice activation privacy settings~ voice activation permissions~ vlue~ vivid~ visual~ visuals~ visual quality of windows mixed reality~ visual feedback when you touch the screen~ visual feedback touch settings~ visual feedback pen settings~ visual feedback on or off~ visual display~ visual cursor for narrator~ visual alerts for audio notifications~ visual alert for audio notifications~ vision~ vision settings~ visible alerts~ virus~ virtual private networks~ virtual private network settings~ virtual desktop~ virtual desktops~ virtual desktop settings~ view~ viewer

Extracted

Family

arrowrat

Botnet

91.134.207.23:5337

Mutex

DFDFrcvff45thfgh4t44gjahdfhhhhca

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3752 set thread context of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2a62004b9c0d801	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2a9c303b9c0d801	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000758e9b08b9c0d801	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001acde903b9c0d801	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b14b0a05b9c0d801	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a76f6e05b9c0d801	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011e56405b9c0d801	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fab36309b9c0d801	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041ce0804b9c0d801	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e0f2e05b9c0d801	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "804"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2797"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5669"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1964"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "29320"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1964"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "789"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1747"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10322"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2860"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "923"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7817"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2797"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1694"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "35670"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "62821"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7817"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "223"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1732"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "35670"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "223"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "789"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1964"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2860"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "35655"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1732"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "35663"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "3597"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2114"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1694"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2797"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3553"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "62821"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3597"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1747"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "35663"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "3553"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10322"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "923"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "3597"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2226"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "62821"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: SeDebugPrivilege	3476	SearchApp.exe
Token: SeDebugPrivilege	3476	SearchApp.exe
Token: SeShutdownPrivilege	5108	explorer.exe
Token: SeCreatePagefilePrivilege	5108	explorer.exe
Token: 33	1432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe
5108	explorer.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4944	StartMenuExperienceHost.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe
3476	SearchApp.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 5108	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	83
PID 3752 wrote to memory of 5108	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	83
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 3752 wrote to memory of 4300	3752	8573d9e75f2c0ef4e69023fc07bee9cb.exe	84
PID 1432 wrote to memory of 2824	1432	SearchIndexer.exe	115
PID 1432 wrote to memory of 2824	1432	SearchIndexer.exe	115
PID 1432 wrote to memory of 4396	1432	SearchIndexer.exe	116
PID 1432 wrote to memory of 4396	1432	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\8573d9e75f2c0ef4e69023fc07bee9cb.exe
"C:\Users\Admin\AppData\Local\Temp\8573d9e75f2c0ef4e69023fc07bee9cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" TY 91.134.207.23 5337 DFDFrcvff45thfgh4t44gjahdfhhhhca
  2⤵
  PID:4300

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4944

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-205-0x000002100AFB0000-0x000002100AFC0000-memory.dmp

Filesize
64KB

Download
memory/1432-207-0x000002100D5A0000-0x000002100D5A8000-memory.dmp

Filesize
32KB

Download
memory/1432-206-0x000002100B1E0000-0x000002100B1F0000-memory.dmp

Filesize
64KB

Download
memory/3476-178-0x0000029BED68D000-0x0000029BED690000-memory.dmp

Filesize
12KB

Download
memory/3476-182-0x0000029BED660000-0x0000029BED663000-memory.dmp

Filesize
12KB

Download
memory/3476-158-0x0000029BED66C000-0x0000029BED670000-memory.dmp

Filesize
16KB

Download
memory/3476-159-0x0000029BED66C000-0x0000029BED670000-memory.dmp

Filesize
16KB

Download
memory/3476-160-0x0000029BED66C000-0x0000029BED670000-memory.dmp

Filesize
16KB

Download
memory/3476-161-0x0000029BED66C000-0x0000029BED670000-memory.dmp

Filesize
16KB

Download
memory/3476-163-0x0000029BED671000-0x0000029BED674000-memory.dmp

Filesize
12KB

Download
memory/3476-164-0x0000029BED671000-0x0000029BED674000-memory.dmp

Filesize
12KB

Download
memory/3476-165-0x0000029BED671000-0x0000029BED674000-memory.dmp

Filesize
12KB

Download
memory/3476-194-0x0000029BED760000-0x0000029BED766000-memory.dmp

Filesize
24KB

Download
memory/3476-173-0x0000029BED689000-0x0000029BED68D000-memory.dmp

Filesize
16KB

Download
memory/3476-171-0x0000029BED689000-0x0000029BED68D000-memory.dmp

Filesize
16KB

Download
memory/3476-172-0x0000029BED689000-0x0000029BED68D000-memory.dmp

Filesize
16KB

Download
memory/3476-174-0x0000029BED689000-0x0000029BED68D000-memory.dmp

Filesize
16KB

Download
memory/3476-177-0x0000029BED68D000-0x0000029BED690000-memory.dmp

Filesize
12KB

Download
memory/3476-179-0x0000029BED68D000-0x0000029BED690000-memory.dmp

Filesize
12KB

Download
memory/3476-148-0x0000029BEA688000-0x0000029BEA690000-memory.dmp

Filesize
32KB

Download
memory/3476-184-0x0000029BED660000-0x0000029BED663000-memory.dmp

Filesize
12KB

Download
memory/3476-150-0x0000029BEB6B0000-0x0000029BEB6D0000-memory.dmp

Filesize
128KB

Download
memory/3476-183-0x0000029BED660000-0x0000029BED663000-memory.dmp

Filesize
12KB

Download
memory/3476-166-0x0000029BED671000-0x0000029BED674000-memory.dmp

Filesize
12KB

Download
memory/3476-192-0x0000029BED760000-0x0000029BED766000-memory.dmp

Filesize
24KB

Download
memory/3476-193-0x0000029BED760000-0x0000029BED766000-memory.dmp

Filesize
24KB

Download
memory/3476-195-0x0000029BED760000-0x0000029BED766000-memory.dmp

Filesize
24KB

Download
memory/3476-196-0x0000029BED760000-0x0000029BED766000-memory.dmp

Filesize
24KB

Download
memory/3476-197-0x0000029BED760000-0x0000029BED766000-memory.dmp

Filesize
24KB

Download
memory/3476-198-0x0000029BED760000-0x0000029BED766000-memory.dmp

Filesize
24KB

Download
memory/3476-202-0x0000029BED769000-0x0000029BED76C000-memory.dmp

Filesize
12KB

Download
memory/3476-201-0x0000029BED769000-0x0000029BED76C000-memory.dmp

Filesize
12KB

Download
memory/3476-203-0x0000029BED769000-0x0000029BED76C000-memory.dmp

Filesize
12KB

Download
memory/3476-152-0x0000029BEBF00000-0x0000029BEBF20000-memory.dmp

Filesize
128KB

Download
memory/3476-157-0x0000029BED66C000-0x0000029BED670000-memory.dmp

Filesize
16KB

Download
memory/3752-132-0x0000000000010000-0x000000000002E000-memory.dmp

Filesize
120KB

Download
memory/3752-133-0x0000000004E90000-0x0000000005434000-memory.dmp

Filesize
5.6MB

Download
memory/3752-134-0x0000000004AD0000-0x0000000004B6C000-memory.dmp

Filesize
624KB

Download
memory/4300-137-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4300-138-0x00000000052D0000-0x0000000005362000-memory.dmp

Filesize
584KB

Download
memory/4396-278-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-382-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-211-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-212-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-213-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-214-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-215-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-216-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-226-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-227-0x0000018E60150000-0x0000018E60160000-memory.dmp

Filesize
64KB

Download
memory/4396-228-0x0000018E60160000-0x0000018E60170000-memory.dmp

Filesize
64KB

Download
memory/4396-229-0x0000018E60C70000-0x0000018E60C80000-memory.dmp

Filesize
64KB

Download
memory/4396-279-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-280-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-281-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-282-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-284-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-283-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-286-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-285-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-287-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-288-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-289-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-306-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-307-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

Filesize
64KB

Download
memory/4396-310-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-315-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-316-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-317-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-318-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

Filesize
64KB

Download
memory/4396-319-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

Filesize
64KB

Download
memory/4396-320-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

Filesize
64KB

Download
memory/4396-363-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-364-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

Filesize
64KB

Download
memory/4396-210-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-381-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-384-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-383-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-417-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-418-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-419-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-420-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-421-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-422-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-423-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-424-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-441-0x0000018E60140000-0x0000018E60150000-memory.dmp

Filesize
64KB

Download
memory/4396-442-0x0000018E62410000-0x0000018E62420000-memory.dmp

Filesize
64KB

Download
memory/4396-443-0x0000018E62410000-0x0000018E62420000-memory.dmp

Filesize
64KB

Download
memory/4396-444-0x0000018E62410000-0x0000018E62420000-memory.dmp

Filesize
64KB

Download
memory/4396-445-0x0000018E62410000-0x0000018E62420000-memory.dmp

Filesize
64KB

Download
memory/4396-446-0x0000018E60160000-0x0000018E60170000-memory.dmp

Filesize
64KB

Download
memory/4396-447-0x0000018E60C70000-0x0000018E60C80000-memory.dmp

Filesize
64KB

Download
memory/4396-448-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-449-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-450-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-451-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-452-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-453-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-454-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-455-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-456-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-457-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-459-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-458-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

Filesize
64KB

Download
memory/4396-460-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download
memory/4396-461-0x0000018E61420000-0x0000018E61430000-memory.dmp

Filesize
64KB

Download