2c517cd034d6234989c611d6ea7e1cb2464727fa75dadcb4a613a27e441c0ce2

Resubmissions

18/09/2023, 17:06

230918-vmxxbsah3x 4

18/09/2023, 16:22

230918-tvhlyaae5v 3

18/09/2023, 16:13

230918-tpchqsae2t 3

Analysis

max time kernel
508s
max time network
514s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 16:13

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Screenshot 2023-05-11 10.34.31.png
Size

773KB
MD5

81e22b893267f34414cdca894907ec3c
SHA1

1a98db8f947c79389f7f119098ff51dda4d4eea7
SHA256

2c517cd034d6234989c611d6ea7e1cb2464727fa75dadcb4a613a27e441c0ce2
SHA512

18fa040f6c4b4027fa7e4e04c6fd859a4af492280aafef7f28f8edc4fd80703a92021403560cdfb507e4c2e21bb19973133a1609a422cc6104c5a98ed7127f1f
SSDEEP

24576:8+9PuUvR4xD4Zad3AeanHnJqfIVSkWTG7RphfhMJS:80ux9eCiUkWTG7RfhM0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "24"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
1904	SearchApp.exe
1132	SearchApp.exe
4864	SearchApp.exe
4436	SearchApp.exe
2492	SearchApp.exe
2812	SearchApp.exe
4884	SearchApp.exe
4460	SearchApp.exe
4060	SearchApp.exe
4244	SearchApp.exe
2500	SearchApp.exe
3196	SearchApp.exe
436	SearchApp.exe
628	SearchApp.exe
736	SearchApp.exe
2372	SearchApp.exe
996	SearchApp.exe
836	SearchApp.exe
4828	SearchApp.exe
3420	SearchApp.exe
4656	SearchApp.exe
2616	SearchApp.exe
3928	OpenWith.exe
3964	SearchApp.exe
316	SearchApp.exe
1784	SearchApp.exe
4492	SearchApp.exe
2948	SearchApp.exe
3140	SearchApp.exe
4556	SearchApp.exe
1972	LogonUI.exe
4068	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 836	3628	msedge.exe	207
PID 3628 wrote to memory of 836	3628	msedge.exe	207
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 4600	3628	msedge.exe	208
PID 3628 wrote to memory of 3748	3628	msedge.exe	210
PID 3628 wrote to memory of 3748	3628	msedge.exe	210
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212
PID 3628 wrote to memory of 5008	3628	msedge.exe	212

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2023-05-11 10.34.31.png"
1⤵
PID:1940

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4600

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1904

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4884

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4460

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4244

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3196

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:436

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:628

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:736

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:996

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:836

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3420

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4656

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2616

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3928

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:316

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1784

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4492

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd3598b38h0e76h408aha9ddhcb230fcdfa11
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa33e146f8,0x7ffa33e14708,0x7ffa33e14718
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6083942893940624125,1074662746259918726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6083942893940624125,1074662746259918726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,6083942893940624125,1074662746259918726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3140

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4068

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa389b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
479daaa9320eb567ca78e877767373bd

SHA1
c5cfaaa8b210a9e48978893282d7194b136ad5b7

SHA256
c62e1b52d55190d28f647212e22d797fe49f1cb79ab22525651e3aaa912cbbe8

SHA512
08015ce6c1e6bd06a064094d34a9dad34cf35640e36bf114193a8d7c48b37340754746403f4b253611df7fbc0fc8d7192960a87f69a535d36cb49c623cf8ea35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
fd2f7d0d1a166b2bd95c8f4ed9141282

SHA1
f664773229b62d3d62899a7444e409f98a0b8f25

SHA256
8cedb254ffdcd4a36aaa3df59f4efd29987493fdfeee62e3e3e736d6706b61fb

SHA512
1c6049c30cf943df81b42fca0caf9265c09f6a9fd921f4a2ed3b85f88dd0ea87856bd9cb32b87722fc50e339d756d1c6cbc2eef024788db40e60fc200f83a838

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133395276299296964.txt

Filesize
75KB

MD5
62d81c2e1e8b21733f95af2a596e4b18

SHA1
91c005ecc5ae4171f450c43c02d1ba532b4474c6

SHA256
a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

SHA512
c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\46IOJ2Y1\microsoft.windows[1].xml

Filesize
96B

MD5
132893809ee21f6cc9bd8398d163fde8

SHA1
664b895e0f6ae4f8ed96f36dee355d4e554b29eb

SHA256
af9f28768de7e7f0f21d52b63003adb8fa1b563ab8e4a38bf361a7f51aa8d8d2

SHA512
a540b8cddd2684bf6d11480bc23200200414984b4520842db541e07021520fb6cf356492b7e2517cdd53718f4a8b6002d5268db4c085b5d1ab6ed3cc1973caa8

Download Submit
C:\Windows\System32\lykac0.exe

Filesize
7.2MB

MD5
6087e6cf3f39f152e9d8cfe4e5b8f662

SHA1
897cc873db94b18bd9ff867b6fd001a04b32410e

SHA256
33e6e88b827c25365bec6bf2ed42e3c65e058183685b84c5215b0bf92a672857

SHA512
6f5fa1431783a3aa6be6e3e8ad4be9ac87962525fe933c8f1466f614491342ceaf7ada62c8441f46892bd08d3826f7637a9d4444fa9aa00d3ccac8f74a29d743

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

Filesize
380KB

MD5
d094fc933e0421b978b4480bb2a34c91

SHA1
2d62ca13c08bbaf70a189b51bfab0479a434ff20

SHA256
1ccec37a3cf6afa478bbf9786211850bb4aa7ab8cf6c70b73f5ad694bc12c039

SHA512
7f948a7ee265b098283ceacfa252b5dab235c485c10d24928a28c38dd0ed29c4405bc51a1395ed1d5b90a6d66acd52e2b27266c211b3edbaf1de0a7ee3d664c5

Download Submit
C:\vcredist2010_x64.log.html

Filesize
86KB

MD5
bd2156f76f21ed0be92f83050d01c971

SHA1
a4f4c47a93299ed4d6dd3f56d772f62e6f59a543

SHA256
2a648f898c7503955cdada80313f3ce3e8c85d3831b4b749c44996ab011568e7

SHA512
73deceb9a04dc331ec8cd5626ce2a6e2327ccbce39155c368cd3175f26c3b6ad85af0bda0710a043601c025e7c32f974d1d28c01d8b79e884f7a476741ce1b0b

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

Filesize
395KB

MD5
b496bf554c1e5adfe05ed1ca557df99b

SHA1
ce5e6d77ef59562298731e29405eb3ae31aa5890

SHA256
361045a0fa489bd2c6c0436957f310b164204af1be69b196b3ded5133ea0f381

SHA512
7c478f1e33e09a944a98e4cc77627d06fb5f819f0501f5b2e91199a822dfee8d487fcd3fa3c7b9f2d50f010f0a5844cd49157002b0e6b0a71cd4a4edde3c9bf4

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
414e9f81be683d832eec4ca9274f813b

SHA1
1d42fb224d21d340ac8569e35f089bd9481f7189

SHA256
e9b82da92e5fe57d746a6673162e359362813fa1338a6f651a09a9528aec7a75

SHA512
dbf5b5ccf02eb215674c34e03f5bb125c31f2d42abf0c594ed513c76032e7b08822e2b052dc9d870548aac56fbb62fc4d1cb9532e529e533aca5355da8eef637

Download Submit
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

Filesize
167KB

MD5
2d8cda0044941c757d80296e4a50b8e1

SHA1
937a8e535acfbe64d4b59ece989744e5b2f353c7

SHA256
8ec3b1a770a5cc5bb77543de83c7446fab3bd4cbbc1164e6a1ec4d75c375b9d6

SHA512
085126a16040b4964849131145644830db9105fb263593b29733d40a19fb6e9fd598f4cd7fe952eb68f19c5f7f5ad89e669d850cecd3bf360d5c0ae0874e4e1a

Download Submit
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

Filesize
195KB

MD5
0cb7ec9d44c8c8d003dd941ce89ab9ed

SHA1
fb8193c2b4deac114b6b71042869b8f0e55fca8a

SHA256
081afb6652c844cb5358eaee7ae41606c11bd1c676b6cdd11b6f90c6b3873a54

SHA512
ecfde65b0e47ffcabedbc734821a195067d8e0bff08a89be35737aa702281bff21ee5c9c77a456e93c0642cedafa71660e8fbf8c8de32f3da17d360cdf3c793a

Download Submit
C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

Filesize
170KB

MD5
9cc7434e950271d2c092a8f08af26185

SHA1
db0cd6f7eff3c9719d9fd36b558474198d076fd1

SHA256
725a6e01d82b0810a739c799caa2164a928425877dc15f4178ec5221af4228a6

SHA512
2b7ebcd37f0dd48d7c774e6c6a4777c03a7e80210f5032183dbeb2cb7ccb5b48f9eda4adeb5919487cd170c61752f6ec11e1e6b78c8d5cac83368f43634360a6

Download Submit
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log

Filesize
208KB

MD5
fa891a33c2639eba90a9d2ff3757821e

SHA1
394fe8cfdf78cefdf62b7a09634ca2c8f1f52037

SHA256
33248ef257a1b5f463f609589ed8d83c091885a150b50bfcd53570036f905a41

SHA512
44864ea3785b014181150d3e00ec1e34b60dd3a2112c23c5041b149c582c14784203c5cc91c4d637b8043451d01689fb346b234e0cb1799ac3e79df44a092240

Download Submit
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

Filesize
170KB

MD5
407c410f4c93bdb8d7c5997e9d81b6e6

SHA1
4b34190dd361cec24b824dae85acafb5ead785ee

SHA256
6033486073ea463b0a22e217a2d1c7c2b49d41bc92e573288a30ffbff101f95d

SHA512
fc8836679d404c854c89f03dbb570a2aa7be6c7ef1c26fe006f63e3daf968b208f7d73037bebb3db0a0cb717f6198df81f6b5fd8f9bbb5457313663e90252bf8

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

Filesize
190KB

MD5
67c1d166e107ec9b5770b206fa9a91e7

SHA1
d4edac156b11c953f970613bde9b6b30fd439d5a

SHA256
3009b753bf762d74a94bb6abee467965e505b5eec66231f762a0f58d6a106a14

SHA512
50652c93fa11d90f2bae211f79ab36b3fa2f3e57c568698ff6c79810aae7adcdfb64db8c80b8b3d04fc1c76d1e23433e85e34fd33680ae221b21e330d9c6a1f1

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

Filesize
170KB

MD5
409f04f60eb60e29ec086caaba929574

SHA1
c7079a188affe00b5564c12a39bdf6b40be7eb4f

SHA256
54a5dc30515956ff03039ffbe4784750b04fc9b43e166f26b46504eb58bc3616

SHA512
cd50fc2ad610d6e288b5140f1f2a8611c5e36dbe75c213d8322a257f0de9605c629ed8548fbd44db4d6ad54230b1187aa3a88b2d485c2bc7caea38fea81a7774

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

Filesize
198KB

MD5
7023f03eb48e54785e4b2d9e424f0a47

SHA1
294bdb1109faeb6fa411df7158393b0c6ec8857d

SHA256
f4e404ecdde68223225f68f840ede295ace2637b8360b28be1f1e168fd8aa58c

SHA512
8bd398d77c6767e2c0e683688ac8858296b541133617b199d3b68c62fdbdad51e3c33933358a9baaf98e625567b7fc5e72dbddc6ed84a7a52093bfc5dc5334b0

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

Filesize
123KB

MD5
7d3677255f94d7c5a4da03c5040d1f9b

SHA1
703652c80c6aa6702093edb50c0be3ad61633ad7

SHA256
3e1d7eeea607b52d9efca41aef17ba418e0c040c38887a3a3348656a31d78f5d

SHA512
4c5ecd308da74287370700ff2e8628aa82da7cabf779a86f07335695d76a0a51591f2f8af20e0ce1c4db010315ff0a0b598ae0a4a909a08e372c329beb9a1e13

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

Filesize
129KB

MD5
b83831cf080f283ee300f79e1022df7b

SHA1
39ffd4e4cb9295ecdbc43aaf7c39df9a01db2fc1

SHA256
3288f98ad4cca0c79b34e4c1f3b8ef03b8c0620fa4d3fd59769f4fbcb5c49b1f

SHA512
cac32ceb9d0e7c604eafbabe3218c4e4a7ff3c933abe3521b9250497d4905f54740c9ed9d7911431e35622a610c993cb1e3796fbb381805e98e9243cd32f7251

Download Submit
C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log

Filesize
123KB

MD5
e1f7af28656b72fd31a071e91a49eb5e

SHA1
7047e2686528671664d880b6c2a9ab925ea5b8a3

SHA256
91fef27d93c901306374e252b8ddc42ddbd05b2b90d0172df1de9aaf9b24ad1a

SHA512
79dc9a9119c421ec0360ce3cae7aae56c23ebd7fa155d3ec22c8bb4695869aad3028a7dae596108e2ee3898b7d01a0646d1820dec81ee00642e83f7b212f240d

Download Submit
C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log

Filesize
135KB

MD5
4d94755b7055bd8be4047227759b0c21

SHA1
e2c438ec98d932312002629104aab0aceb89f3e5

SHA256
fb732a8a5907dd433c0cb231edcc409139c453029b5e62d27ccc82a9c468f54c

SHA512
36214adc011c59f91a6c2b6953433b7cfd9d4e2749a1a91abaca5344ea8af7eb70e55b765a0406000630381e8e7ed86644715f84c3a78ee38792d67b1fc1b660

Download Submit
memory/436-316-0x000001DFC9E90000-0x000001DFC9EB0000-memory.dmp

Filesize
128KB

Download
memory/436-314-0x000001DFC9ED0000-0x000001DFC9EF0000-memory.dmp

Filesize
128KB

Download
memory/436-318-0x000001DFCA2E0000-0x000001DFCA300000-memory.dmp

Filesize
128KB

Download
memory/628-336-0x00000232702D0000-0x00000232702F0000-memory.dmp

Filesize
128KB

Download
memory/628-339-0x0000023270290000-0x00000232702B0000-memory.dmp

Filesize
128KB

Download
memory/628-343-0x00000232706A0000-0x00000232706C0000-memory.dmp

Filesize
128KB

Download
memory/736-350-0x000001F610FD0000-0x000001F610FF0000-memory.dmp

Filesize
128KB

Download
memory/736-352-0x000001F610F90000-0x000001F610FB0000-memory.dmp

Filesize
128KB

Download
memory/736-354-0x000001FE12440000-0x000001FE12460000-memory.dmp

Filesize
128KB

Download
memory/836-414-0x000002020D130000-0x000002020D150000-memory.dmp

Filesize
128KB

Download
memory/836-411-0x000002020CD20000-0x000002020CD40000-memory.dmp

Filesize
128KB

Download
memory/836-409-0x000002020CD60000-0x000002020CD80000-memory.dmp

Filesize
128KB

Download
memory/996-393-0x0000027904A90000-0x0000027904AB0000-memory.dmp

Filesize
128KB

Download
memory/996-391-0x0000027904440000-0x0000027904460000-memory.dmp

Filesize
128KB

Download
memory/996-389-0x0000027904480000-0x00000279044A0000-memory.dmp

Filesize
128KB

Download
memory/1132-47-0x000001BBE3170000-0x000001BBE3190000-memory.dmp

Filesize
128KB

Download
memory/1132-45-0x000001BBE2D60000-0x000001BBE2D80000-memory.dmp

Filesize
128KB

Download
memory/1132-43-0x000001BBE2DA0000-0x000001BBE2DC0000-memory.dmp

Filesize
128KB

Download
memory/1904-28-0x00000250CE000000-0x00000250CE020000-memory.dmp

Filesize
128KB

Download
memory/1904-26-0x00000250CDBF0000-0x00000250CDC10000-memory.dmp

Filesize
128KB

Download
memory/1904-22-0x00000250CDC30000-0x00000250CDC50000-memory.dmp

Filesize
128KB

Download
memory/2372-373-0x000001358C120000-0x000001358C140000-memory.dmp

Filesize
128KB

Download
memory/2372-375-0x000001358C520000-0x000001358C540000-memory.dmp

Filesize
128KB

Download
memory/2372-370-0x000001358C160000-0x000001358C180000-memory.dmp

Filesize
128KB

Download
memory/2492-108-0x00000200B0820000-0x00000200B0840000-memory.dmp

Filesize
128KB

Download
memory/2492-114-0x00000200B0C20000-0x00000200B0C40000-memory.dmp

Filesize
128KB

Download
memory/2492-111-0x00000200B05D0000-0x00000200B05F0000-memory.dmp

Filesize
128KB

Download
memory/2500-271-0x00000291349E0000-0x0000029134A00000-memory.dmp

Filesize
128KB

Download
memory/2500-275-0x0000029936100000-0x0000029936120000-memory.dmp

Filesize
128KB

Download
memory/2500-273-0x00000291349A0000-0x00000291349C0000-memory.dmp

Filesize
128KB

Download
memory/2616-492-0x00000249E5FD0000-0x00000249E5FF0000-memory.dmp

Filesize
128KB

Download
memory/2812-164-0x000001D4A24E0000-0x000001D4A2500000-memory.dmp

Filesize
128KB

Download
memory/2812-166-0x000001D4A24A0000-0x000001D4A24C0000-memory.dmp

Filesize
128KB

Download
memory/2812-168-0x000001D4A2B00000-0x000001D4A2B20000-memory.dmp

Filesize
128KB

Download
memory/3196-296-0x0000019D2CBB0000-0x0000019D2CBD0000-memory.dmp

Filesize
128KB

Download
memory/3196-294-0x0000019D2CF00000-0x0000019D2CF20000-memory.dmp

Filesize
128KB

Download
memory/3196-298-0x0000019D2D310000-0x0000019D2D330000-memory.dmp

Filesize
128KB

Download
memory/3420-452-0x0000024B6CD20000-0x0000024B6CD40000-memory.dmp

Filesize
128KB

Download
memory/3420-454-0x0000024B6C9E0000-0x0000024B6CA00000-memory.dmp

Filesize
128KB

Download
memory/3420-456-0x0000024B6D0F0000-0x0000024B6D110000-memory.dmp

Filesize
128KB

Download
memory/4060-231-0x00000287DBDE0000-0x00000287DBE00000-memory.dmp

Filesize
128KB

Download
memory/4060-229-0x00000287DB990000-0x00000287DB9B0000-memory.dmp

Filesize
128KB

Download
memory/4060-227-0x00000287DB9D0000-0x00000287DB9F0000-memory.dmp

Filesize
128KB

Download
memory/4244-252-0x00000207D4290000-0x00000207D42B0000-memory.dmp

Filesize
128KB

Download
memory/4244-254-0x00000207D46E0000-0x00000207D4700000-memory.dmp

Filesize
128KB

Download
memory/4244-250-0x00000207D42D0000-0x00000207D42F0000-memory.dmp

Filesize
128KB

Download
memory/4436-89-0x0000024E58E80000-0x0000024E58EA0000-memory.dmp

Filesize
128KB

Download
memory/4436-87-0x0000024E58EC0000-0x0000024E58EE0000-memory.dmp

Filesize
128KB

Download
memory/4436-91-0x0000024E59290000-0x0000024E592B0000-memory.dmp

Filesize
128KB

Download
memory/4460-206-0x0000019679010000-0x0000019679030000-memory.dmp

Filesize
128KB

Download
memory/4460-209-0x0000019678FD0000-0x0000019678FF0000-memory.dmp

Filesize
128KB

Download
memory/4460-213-0x00000196793F0000-0x0000019679410000-memory.dmp

Filesize
128KB

Download
memory/4656-474-0x00000210DDE50000-0x00000210DDE70000-memory.dmp

Filesize
128KB

Download
memory/4656-472-0x00000210DDE90000-0x00000210DDEB0000-memory.dmp

Filesize
128KB

Download
memory/4656-476-0x00000210DE260000-0x00000210DE280000-memory.dmp

Filesize
128KB

Download
memory/4828-433-0x000001EC63BE0000-0x000001EC63C00000-memory.dmp

Filesize
128KB

Download
memory/4828-431-0x000001EC635D0000-0x000001EC635F0000-memory.dmp

Filesize
128KB

Download
memory/4828-429-0x000001EC63610000-0x000001EC63630000-memory.dmp

Filesize
128KB

Download
memory/4864-70-0x0000016A880E0000-0x0000016A88100000-memory.dmp

Filesize
128KB

Download
memory/4864-68-0x0000016A867D0000-0x0000016A867F0000-memory.dmp

Filesize
128KB

Download
memory/4864-66-0x0000016A86B20000-0x0000016A86B40000-memory.dmp

Filesize
128KB

Download
memory/4884-185-0x00000264FA180000-0x00000264FA1A0000-memory.dmp

Filesize
128KB

Download
memory/4884-187-0x00000264FA140000-0x00000264FA160000-memory.dmp

Filesize
128KB

Download
memory/4884-189-0x00000264FA550000-0x00000264FA570000-memory.dmp

Filesize
128KB

Download