Resubmissions
11-10-2024 15:01
241011-sdwa2ayblh 702-10-2024 03:16
241002-dsqa1avapn 802-10-2024 03:04
241002-dkt9zsxfna 702-10-2024 02:53
241002-ddfg9axcpa 702-10-2024 02:33
241002-c15vzssgkp 7Analysis
-
max time kernel
707s -
max time network
995s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 03:16
Behavioral task
behavioral1
Sample
MKMA.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MKMA.exe
Resource
win10v2004-20240802-en
General
-
Target
MKMA.exe
-
Size
132.8MB
-
MD5
26210a8c2404f926deeaff3a0b078650
-
SHA1
036222021f2905127521b863d3b45a57d377996c
-
SHA256
11268095435c4f1de4e84c48b39db70f6f405c5d9619b8f4708d2accdb6c878a
-
SHA512
6a6c590bb314ecb8c52fc466020226ff472ead6ac1564d0dd71ec20568a22acc95709fb92bbd4d8d9233f295ca2e2c9e3d0d2822a441fa3b2d595353437d8205
-
SSDEEP
3145728:b6mC1E0qtOU9SC++6y9MgYR5tyJb2PlRy3gWINvmbcad:boHqtOnC4y9Mx5u27PNkca
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 35 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation cmd.exe -
Loads dropped DLL 64 IoCs
pid Process 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe 4840 MKMA.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
pid Process 2072 Powershell.exe 3892 Powershell.exe 4388 Powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 MKMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe -
Kills process with taskkill 1 IoCs
pid Process 1976 taskkill.exe -
Modifies File Icons 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\164 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\208 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\222 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\58 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\102 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\375 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\382 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\83 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\334 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\202 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\259 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\265 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\323 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\330 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\352 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\89 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\111 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\101 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\191 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\316 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\380 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\5 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\35 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\38 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\347 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\386 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\24 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\36 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\67 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\137 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\147 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\197 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\201 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\286 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\37 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\64 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\360 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\361 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\366 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\320 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\340 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\162 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\214 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\32 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\66 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\77 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\96 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\143 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\170 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\227 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\239 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\4 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\39 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\253 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\78 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\100 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\188 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\348 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\18 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\56 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\246 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\250 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\329 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons MKMA.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\299 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\29 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\290 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\296 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\298 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\295 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\297 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\291 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\292 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\293 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\294 = "C:\\Users\\Admin\\AppData\\Local/MKMA\\MKMAiconnotif.ico" MKMA.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{3AA68276-C93A-49CF-BB30-6A37ABB48B94} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{844EF319-8B44-49D3-8DDF-227440237E37} explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{A50686FC-180A-4E45-8D52-4AE4D2E9FEAB} explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe -
Suspicious behavior: AddClipboardFormatListener 4 IoCs
pid Process 4840 MKMA.exe 4736 MKMA.exe 2392 vlc.exe 4516 MKMA.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3892 Powershell.exe 3892 Powershell.exe 4388 Powershell.exe 4388 Powershell.exe 2072 Powershell.exe 2072 Powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 10 IoCs
pid Process 4840 MKMA.exe 2392 vlc.exe 4736 MKMA.exe 4516 MKMA.exe 5500 explorer.exe 956 explorer.exe 1000 explorer.exe 4340 explorer.exe 4912 explorer.exe 2124 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1544 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1544 AUDIODG.EXE Token: SeDebugPrivilege 3892 Powershell.exe Token: SeDebugPrivilege 4388 Powershell.exe Token: SeDebugPrivilege 2072 Powershell.exe Token: 33 2392 vlc.exe Token: SeIncBasePriorityPrivilege 2392 vlc.exe Token: SeDebugPrivilege 1976 taskkill.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe Token: SeShutdownPrivilege 684 explorer.exe Token: SeCreatePagefilePrivilege 684 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 4736 MKMA.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 684 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 2404 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4840 MKMA.exe 4840 MKMA.exe 4736 MKMA.exe 4736 MKMA.exe 4736 MKMA.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 2392 vlc.exe 4516 MKMA.exe 4516 MKMA.exe 4048 StartMenuExperienceHost.exe 4924 StartMenuExperienceHost.exe 5128 StartMenuExperienceHost.exe 5892 StartMenuExperienceHost.exe 5940 SearchApp.exe 2556 StartMenuExperienceHost.exe 4432 SearchApp.exe 4300 StartMenuExperienceHost.exe 3600 SearchApp.exe 5320 StartMenuExperienceHost.exe 1676 SearchApp.exe 5492 StartMenuExperienceHost.exe 4308 SearchApp.exe 5912 StartMenuExperienceHost.exe 952 SearchApp.exe 2068 StartMenuExperienceHost.exe 3536 SearchApp.exe 3868 StartMenuExperienceHost.exe 3468 SearchApp.exe 2752 StartMenuExperienceHost.exe 956 SearchApp.exe 3564 StartMenuExperienceHost.exe 4180 SearchApp.exe 5880 StartMenuExperienceHost.exe 5212 SearchApp.exe 5912 StartMenuExperienceHost.exe 3620 SearchApp.exe 5324 StartMenuExperienceHost.exe 652 SearchApp.exe 4152 StartMenuExperienceHost.exe 1276 SearchApp.exe 5528 StartMenuExperienceHost.exe 5196 SearchApp.exe 5660 StartMenuExperienceHost.exe 5304 SearchApp.exe 5420 StartMenuExperienceHost.exe 1940 SearchApp.exe 2464 StartMenuExperienceHost.exe 3292 SearchApp.exe 2296 StartMenuExperienceHost.exe 4692 SearchApp.exe 4772 StartMenuExperienceHost.exe 3424 SearchApp.exe 2496 StartMenuExperienceHost.exe 5232 SearchApp.exe 2016 StartMenuExperienceHost.exe 4684 SearchApp.exe 1512 StartMenuExperienceHost.exe 3216 SearchApp.exe 1132 StartMenuExperienceHost.exe 4508 SearchApp.exe 3592 StartMenuExperienceHost.exe 4420 SearchApp.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2784 wrote to memory of 4840 2784 MKMA.exe 82 PID 2784 wrote to memory of 4840 2784 MKMA.exe 82 PID 4360 wrote to memory of 4736 4360 MKMA.exe 97 PID 4360 wrote to memory of 4736 4360 MKMA.exe 97 PID 4736 wrote to memory of 3892 4736 MKMA.exe 99 PID 4736 wrote to memory of 3892 4736 MKMA.exe 99 PID 4736 wrote to memory of 4388 4736 MKMA.exe 101 PID 4736 wrote to memory of 4388 4736 MKMA.exe 101 PID 4736 wrote to memory of 2072 4736 MKMA.exe 103 PID 4736 wrote to memory of 2072 4736 MKMA.exe 103 PID 4736 wrote to memory of 1304 4736 MKMA.exe 105 PID 4736 wrote to memory of 1304 4736 MKMA.exe 105 PID 1304 wrote to memory of 2392 1304 cmd.exe 107 PID 1304 wrote to memory of 2392 1304 cmd.exe 107 PID 3876 wrote to memory of 4516 3876 MKMA.exe 109 PID 3876 wrote to memory of 4516 3876 MKMA.exe 109 PID 4736 wrote to memory of 1976 4736 MKMA.exe 111 PID 4736 wrote to memory of 1976 4736 MKMA.exe 111 PID 4736 wrote to memory of 2784 4736 MKMA.exe 113 PID 4736 wrote to memory of 2784 4736 MKMA.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MKMA.exe"C:\Users\Admin\AppData\Local\Temp\MKMA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\MKMA.exe"C:\Users\Admin\AppData\Local\Temp\MKMA.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4840
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x4ec1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
C:\Users\Admin\AppData\Local\Temp\MKMA.exe"C:\Users\Admin\AppData\Local\Temp\MKMA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\MKMA.exe"C:\Users\Admin\AppData\Local\Temp\MKMA.exe"2⤵
- Checks SCSI registry key(s)
- Modifies File Icons
- Modifies Shortcut Icons
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -ExecutionPolicy Bypass -File 7f8bf8c3-1596-4ebf-9b8a-56fc17bd91e8.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -ExecutionPolicy Bypass -File af992203-3121-4105-8a35-af901eebf445.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -ExecutionPolicy Bypass -File 6b789f70-ff05-41f6-853e-b934f77461b7.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "start "" C:\Users\Admin\AppData\Local\Temp\_MEI43602\Images\010.mp4"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\_MEI43602\Images\010.mp4"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2392
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
-
C:\Windows\explorer.exeexplorer.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2784
-
-
-
C:\Users\Admin\AppData\Local\Temp\MKMA.exe"C:\Users\Admin\AppData\Local\Temp\MKMA.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\MKMA.exe"C:\Users\Admin\AppData\Local\Temp\MKMA.exe"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4516
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4048
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:684
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4924
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:2404
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5128
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5500
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5892
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5940
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:956
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2556
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4432
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
PID:1000
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4300
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3600
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:1784
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5320
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
PID:3768
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5492
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4308
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:624
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:952
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:4340
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2068
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3536
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:5324
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3868
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3468
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:4912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2752
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:956
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2124
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3564
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4180
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:3868
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5880
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5212
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5352
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3620
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3464
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5324
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:652
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5440
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4152
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1276
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:1504
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5528
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5196
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3884
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5660
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5304
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:3760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5420
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1940
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:3332
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2464
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3292
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:4740
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2296
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4692
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4064
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4772
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3424
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:2972
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2496
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5232
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5992
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:1412
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1512
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3216
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
PID:3132
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1884
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1132
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4508
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:856
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3592
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4420
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3844
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:868
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1068
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:4792
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:940
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1304
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:464
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5148
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1392
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:5760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5236
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:416
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4572
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4808
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
PID:4408
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5512
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:764
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:1892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3144
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1672
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6116
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1512
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5792
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3416
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5580
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1704
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5348
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4284
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4952
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1548
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:220
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2372
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3332
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5152
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3328
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5816
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4136
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1916
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6056
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1000
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4128
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1848
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5276
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4136
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1184
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5404
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2828
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3800
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4980
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5208
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1384
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1504
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3544
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1840
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4308
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4320
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1980
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1212
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3884
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5604
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2432
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3580
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:636
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4520
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1740
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5596
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:232
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5528
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3108
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2464
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3548
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4052
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1600
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3132
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5580
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1844
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5720
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5620
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5832
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1612
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4984
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2132
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2172
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:696
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4512
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6072
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:372
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1352
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6124
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1668
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4024
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5748
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:396
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6140
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2056
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5984
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4020
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4688
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3720
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5524
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5636
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:876
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4612
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2436
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4092
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:868
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6004
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1056
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1072
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5344
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1132
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:8
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5792
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6004
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6080
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2708
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6088
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1412
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2960
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5704
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4088
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2512
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:412
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2404
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4400
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1848
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4028
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:652
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2372
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5508
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:684
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:372
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1288
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5140
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:996
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1796
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4304
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1172
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5308
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5592
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1960
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4356
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1704
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1916
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4024
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4640
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5588
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3092
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3120
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:392
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5744
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:180
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5320
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1124
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2536
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1436
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4232
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5660
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:552
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1736
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3600
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4516
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3852
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:980
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5160
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2712
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4076
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:392
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1904
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:628
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5192
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2816
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1340
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6120
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3144
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5228
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
294KB
MD5cd4818b254cb66ebd25655bd2a46b74d
SHA1ba623c78dc277ee173abb3d2d9603b9b5c948e28
SHA25645e6203a5c0888900dca43ea5a9063b7cbfba5ce7507eb463c448fc64b4ccf19
SHA512ed756de58316edac1963071d28430494af91889d51d8a9f3754fff3709d1299a383ab7b36eb06020dbb2e96d1cf3dd544862224f8cac3ce74e1cdbf6000db18c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml
Filesize97B
MD5d28bf9e615b97abc4f63418e57cc40bc
SHA165885f634c0b15cabd1caf45861e7767f3110e44
SHA25692e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7
SHA51223e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0
-
Filesize
576KB
MD501b946a2edc5cc166de018dbb754b69c
SHA1dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA25688f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
SHA51265dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5
-
Filesize
30KB
MD50fe6d52eb94c848fe258dc0ec9ff4c11
SHA195cc74c64ab80785f3893d61a73b8a958d24da29
SHA256446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
SHA512c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86
-
Filesize
5.7MB
MD5817520432a42efa345b2d97f5c24510e
SHA1fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA2568d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
SHA5128673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
-
Filesize
426KB
MD50e8ff02d971b61b5d2dd1ac4df01ae4a
SHA1638f0b46730884fa036900649f69f3021557e2fe
SHA2561aa70b106a10c86946e23caa9fc752dc16e29fbe803bba1f1ab30d1c63ee852a
SHA5127ba616ede66b16d9f8b2a56c3117db49a74d59d0d32eaa6958de57eac78f14b1c7f2dbba9eae4d77937399cf14d44535531baf6f9db16f357f8712dfaae4346a
-
Filesize
6.7MB
MD547307a1e2e9987ab422f09771d590ff1
SHA10dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA2565e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
SHA51221b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
-
Filesize
1.3MB
MD53569693d5bae82854de1d88f86c33184
SHA11a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA2564ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
SHA512e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
-
Filesize
3.4MB
MD5d055566b5168d7b1d4e307c41ce47c4b
SHA1043c0056e9951da79ec94a66a784972532dc18ef
SHA25630035484c81590976627f8face9507caa8581a7dc7630cccf6a8d6de65cab707
SHA5124f12d17aa8a3008caa3ddd0e41d3ed713a24f9b5a465ee93b2e4beccf876d5bdf0259aa0d2dd77ad61bb59dc871f78937ffbe4d0f60638014e8ea8a27caf228d
-
Filesize
428KB
MD52030c4177b499e6118be5b9e5761fce1
SHA1050d0e67c4aa890c80f46cf615431004f2f4f8fc
SHA25651e4e5a5e91f78774c44f69b599fae4735277ef2918f7061778615cb5c4f6e81
SHA512488f7d5d9d8deee9bbb9d63dae346e46efeb62456279f388b323777999b597c2d5aea0ee379bdf94c9cbcfd3367d344fb6b5e90ac40be2ce95efa5bbdd363bcc
-
Filesize
4.0MB
MD565f59cfc0c1c060ce20d3b9ceffbaf46
SHA1cfd56d77506cd8c0671ca559d659dab39e4ad3c2
SHA256c81ad3c1111544064b1830c6f1aef3c1fd13b401546ab3b852d697c0f4d854b3
SHA512d6f6dc19f1a0495026cba765b5a2414b6af0dbfc37b5aceed1cd0ae37b3b0f574b759a176d75b01edd74c6ce9a3642d3d29a3fd7f166b53a41c8978f562b4b50
-
Filesize
322KB
MD503761f923e52a7269a6e3a7452f6be93
SHA12ce53c424336bcc8047e10fa79ce9bce14059c50
SHA2567348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
SHA512de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
-
Filesize
145KB
MD5a016545f963548e0f37885e07ef945c7
SHA1cbe499e53ab0bd2da21018f4e2092e33560c846f
SHA2566b56f77da6f17880a42d2f9d2ec8b426248f7ab2196a0f55d37ade39e3878bc6
SHA51247a3c965593b97392f8995c7b80394e5368d735d4c77f610afd61367ffe7658a0e83a0dbd19962c4fa864d94f245a9185a915010afa23467f999c833982654c2
-
Filesize
5.2MB
MD54cd1f8fdcd617932db131c3688845ea8
SHA1b090ed884b07d2d98747141aefd25590b8b254f9
SHA2563788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
SHA5127d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
-
Filesize
2.4MB
MD583c5ff24eae3b9038d74ad91dc884e32
SHA181bf9f8109d73604768bf5310f1f70af62b72e43
SHA256520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
SHA51238ff01891ad5093d0e4f222c5ab703a540514271bf3b94fb65f910193262af722adb9d4f4d2bd6a54c090a7d631d8c98497b7d78bd21359fdea756ff3ac63689
-
Filesize
122KB
MD5b8d249a5e394b4e6a954c557af1b80e6
SHA1b03bb9d09447114a018110bfb91d56ef8d5ec3bb
SHA2561e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
SHA5122f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007
-
Filesize
285KB
MD5201aa86dc9349396b83eed4c15abe764
SHA11a239c479e275aa7be93c5372b2d35e98d8d8cec
SHA2562a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
SHA512bb2cd185d1d936ceca3cc20372c98a1b1542288ad5523ff8b823fb5e842205656ec2f615f076929c69987c7468245a452238b509d37109c9bec26be5f638f3b7
-
Filesize
1.5MB
MD5f187dfdccc102436e27704dc572a2c16
SHA1be4d499e66b8c4eb92480e4f520ccd8eaaa39b04
SHA256fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
SHA51275002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
43KB
MD56bc084255a5e9eb8df2bcd75b4cd0777
SHA1cf071ad4e512cd934028f005cabe06384a3954b6
SHA2561f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
SHA512b822538494d13bda947655af791fed4daa811f20c4b63a45246c8f3befa3ec37ff1aa79246c89174fe35d76ffb636fa228afa4bda0bd6d2c41d01228b151fd89
-
Filesize
69KB
MD5cc0f232f2a8a359dee29a573667e6d77
SHA1d3ffbf5606d9c77a0de0b7456f7a5314f420b1f7
SHA2567a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d
SHA51248484177bf55179607d66f5a5837a35cd586e8a9fb185de8b10865aab650b056a61d1dc96370c5efc6955ccb4e34b31810f8e1c8f5f02d268f565a73b4ff5657
-
Filesize
83KB
MD5dd26ed92888de9c57660a7ad631bb916
SHA177d479d44d9e04f0a1355569332233459b69a154
SHA256324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
SHA512d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897
-
Filesize
175KB
MD5d8caf1c098db12b2eba8edae51f31c10
SHA1e533ac6c614d95c09082ae951b3b685daca29a8f
SHA256364208a97336f577d99bbaaed6d2cf8a4a24d6693b323de4665f75a964ca041d
SHA51277e36f4fb44374b7c58a9005a1d7dfeb3214eabb90786e8a7c6593b5b1c7a305d6aa446be7a06ae0ff38f2bedea68cacb39053b7b7ec297bff3571b3922fd938
-
Filesize
122KB
MD5c8afa1ebb28828e1115c110313d2a810
SHA11d0d28799a5dbe313b6f4ddfdb7986d2902fa97a
SHA2568978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
SHA5124d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56
-
Filesize
156KB
MD58cfbafe65d6e38dde8e2e8006b66bb3e
SHA1cb63addd102e47c777d55753c00c29c547e2243c
SHA2566d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
SHA512fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4
-
Filesize
6KB
MD5d10da531a2ba14b3cab26a3ff737269d
SHA14e7904f1fdf63b8404bbb4c03abd9d19c8622f78
SHA256c21bf3706fb4991a68cdb2a67d35ccf16bd087bb1a8692b59e39c02f3b7a4d6a
SHA512ab83ccaeae1cdae5275f0a16a41155f565569f6f38cf4ff4b1d07dd08fc0c134616060d5ace460cd790a0c04b9b4b784ad83b11fac52428828f38e0ea64988e8
-
Filesize
1.3MB
MD5605cf0c0ef63fe301e94cbc073a503b8
SHA112589064c85195249a53656ea9a8ce6d1ae13ae6
SHA256730a7bc70fdc6f06751d8f96604a5106563e0954602b0413f086956dbd3e9d5c
SHA5129432476968b6dd04f9f6dd63987f7ce7693392f0d7b8f82d1f7a56e937607c016ec12d58c8fab32446ef1f2de55a0216767614eaae6f487a2bfc545ff4c78e4b
-
Filesize
39B
MD57e337c022f22e8f6c52d295f4b15bb79
SHA1a0d34cd2511ca61f25c16997384e1b553b4147df
SHA256bbe7e45e44d908ddf7aeffa268bb8decb7c4d6246c3bc96ee2a5e05664396b4e
SHA512d7cc00579269070d6fd83de62fc456087b72d3978874e9a0ebc44f2d2bc16b01d811f63a656b35aba17268c0318c54fbe15a8abd64953c5102663ae8faaddeb6
-
Filesize
532B
MD56266c96dd59ae8b39c57b123eedf3a1b
SHA11373f26b086d2e6cc3109c221a577c700a321ff6
SHA2565b35d6ec75ff099b924c0e9e13f00c599c4c6e7dae319ae73f1536a8adb01ae6
SHA51249aa3dad78e5222a862389c7ebd90147908a42d3e8e4a543f6c77ce5ce83f13d559284272ad8c57528558a24de7e3b53eacb9efd599909a32182e776d85017f2
-
Filesize
8KB
MD548adaea167cc01ec1a0ce3578f802a56
SHA11000bb08474d39fd6261384e66222487b496f1de
SHA25600d3500367a285ac6a9408170340c4c0e98ad64bf907a6ddb3d0caccef579e84
SHA5126550bb505aa286ac6f3c69a44dd87c36051de30df058d7e99cd8b23272657e55d1a28e7fc92cb99b05ee25f19a842ca0a03882aa7105921a6c4ce365077aedac
-
Filesize
639KB
MD5236f879a5dd26dc7c118d43396444b1c
SHA15ed3e4e084471cf8600fb5e8c54e11a254914278
SHA2561c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
SHA512cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254
-
Filesize
408B
MD51125c481a7689d912cff01ad5f3dd612
SHA14652f218dcb581febde6be3bf2a0ba95c631786a
SHA256039cde5cc09b5d183fa74f59b5180f56ae506e9f0b1840c8de92303374750767
SHA51221ecd421d1a0282c2828d6a01baeb3cdd04d5081be168680e2d7bd76b8fc2b21f6d202af429fd5b45659ecc223b2548b9616b1885567aba396279e8be1977469
-
Filesize
3.2MB
MD52247ee4356666335df7d72129af8d600
SHA1f0131c1a67fc17c0e8dcc4a4ca38c9f1780e7182
SHA25650fad5605b3d57627848b3b84a744dfb6a045609b8236b04124f2234676758d8
SHA51267f2a7bf169c7b9a516689cf1b16446ca50e57f099b9b742ccb1abb2dcde8867f8f6305ad8842cd96194687fc314715ae04c1942b0e0a4f51b592b028c5b16d3
-
Filesize
5.0MB
MD5e547cf6d296a88f5b1c352c116df7c0c
SHA1cafa14e0367f7c13ad140fd556f10f320a039783
SHA25605fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA5129f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
238KB
MD5c540308d4a8e6289c40753fdd3e1c960
SHA11b84170212ca51970f794c967465ca7e84000d0e
SHA2563a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
SHA5121dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b
-
Filesize
259KB
MD5ead020db018b03e63a64ebff14c77909
SHA189bb59ae2b3b8ec56416440642076ae7b977080e
SHA2560c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
SHA512c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5
-
Filesize
25KB
MD5307ef797fc1af567101afba8f6ce6a8c
SHA10023f520f874a0c3eb3dc1fe8df73e71bde5f228
SHA25657abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
SHA5125b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e
-
Filesize
359KB
MD5e1adac219ec78b7b2ac9999d8c2e1c94
SHA16910ec9351bee5c355587e42bbb2d75a65ffc0cf
SHA256771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
SHA512da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67
-
Filesize
45KB
MD5245498839af5a75cd034190fe805d478
SHA1d164c38fd9690b8649afaef7c048f4aabb51dba8
SHA256ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
SHA5124181dea590cbc7a9e06729b79201aa29e8349408cb922de8d4cda555fc099b3e10fee4f5a9ddf1a22eaec8f5ede12f9d6e37ed7ad0486beb12b7330cca51a79e
-
Filesize
206KB
MD53a26cd3f92436747d2285dcef1fae67f
SHA1e3d1403be06beb32fc8dc7e8a58c31e18b586a70
SHA256e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
SHA51273d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f
-
Filesize
768KB
MD519a2aba25456181d5fb572d88ac0e73e
SHA1656ca8cdfc9c3a6379536e2027e93408851483db
SHA2562e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
-
Filesize
422KB
MD57d40a697ca6f21a8f09468b9fce565ad
SHA1dc3b7f7fc0d9056af370e06f1451a65e77ff07f7
SHA256ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
SHA5125a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a
-
Filesize
437KB
MD52c5aca898ff88eb2c9028bbeefebbd1e
SHA17a0048674ef614bebe6cc83b1228d670372076c9
SHA2569a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
SHA51246fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13
-
Filesize
41KB
MD5df538704b8cd0b40096f009fd5d1b767
SHA1d2399fbb69d237d43624e987445694ec7e0b8615
SHA256c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
SHA512408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4
-
Filesize
197KB
MD5815f1bdabb79c6a12b38d84aa343196d
SHA1916483149875a5e20c6046ceffef62dd6089ddd5
SHA25631712ae276e2ced05ecda3e1c08fbbcc2cff8474a972626aba55f7797f0ed8c9
SHA5121078e7e48b6f6ed160ae2bccf80a43a5f1cca769b8a690326e112bf20d7f3d018f855f6aa3b56d315dc0853472e0affcfe8e910b5ce69ce952983cfaa496c21d
-
Filesize
899B
MD51298138791b1f707f862d39399f4aff7
SHA1cb2c58d7ad6bc5093688ebc28f5411544c797133
SHA256cc550db032e61fd3efa68f98129bdf5b6ada43203a10bfc15b70ae3f5d1820a5
SHA512bbe5517e97ffb388848817941a0c80e1e1af9d7887dba072ced6f1bb8b1b4b3b84ed73d2602ebeb7811a85c21c11b5bf891015a170cb64b9c3e50ead10c94e63
-
Filesize
8B
MD5d5b0eaf0ea4aa52b0dab64b782f42a29
SHA136610e835a94dc7a61ef9309348a9561774ea896
SHA256f7ff302fd49cbfcfc2b3c1c9c891c6bf1d6fc1712bb2ebe5b00a8d64b709411d
SHA51270241fcf496c6c14019c9611d0c9597a4ab4e4fea249a17702a9d255a701852008d6a530fc9f5df59f2e9b6b6f8b915545d1caccb919e2c2d9649c7295442e8d
-
Filesize
66KB
MD58dbe9bbf7118f4862e02cd2aaf43f1ab
SHA1935bc8c5cea4502d0facf0c49c5f2b9c138608ed
SHA25629f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
SHA512938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4
-
Filesize
6.6MB
MD5cae8fa4e7cb32da83acf655c2c39d9e1
SHA17a0055588a2d232be8c56791642cb0f5abbc71f8
SHA2568ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
SHA512db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c
-
Filesize
131KB
MD526d752c8896b324ffd12827a5e4b2808
SHA1447979fa03f78cb7210a4e4ba365085ab2f42c22
SHA256bd33548dbdbb178873be92901b282bad9c6817e3eac154ca50a666d5753fd7ec
SHA51299c87ab9920e79a03169b29a2f838d568ca4d4056b54a67bc51caf5c0ff5a4897ed02533ba504f884c6f983ebc400743e6ad52ac451821385b1e25c3b1ebcee0
-
Filesize
30KB
MD579ce1ae3a23dff6ed5fc66e6416600cd
SHA16204374d99144b0a26fd1d61940ff4f0d17c2212
SHA256678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
SHA512a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
C:\Users\Admin\AppData\Local\Temp\_MEI27842\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
Filesize1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1
-
Filesize
1.7MB
MD53ae729942d15f4f48b1ea8c91880f1f4
SHA1d27596d14af5adeb02edab74859b763bf6ac2853
SHA256fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760
SHA512355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245
-
Filesize
3KB
MD5ad243ec8f47745e61b33160c8d4aa55c
SHA1bfdea9157b404ff5ca14dd0b8ff393148e38f6c4
SHA256517e695174bd2f84c381ba02cb531dff240362004688a3cf19d40e80790d4bff
SHA5120f1e15b33a0dad96edb5d941f9adff2b02e82c9c496524097f20eab6436d6b8614a901979b3da2eb31888887875f17fdb538ae499149db939a19247df2305a07
-
Filesize
5KB
MD59826c2d1e78f1228b503c21d7884721d
SHA1ea2d19fcd0e8e7390ff1cdf8b564809afbb0f482
SHA256c961aa5aa32f53a509cbb807216357cf7c12950ee19bd2b78bd3661960894500
SHA512efca063a07adc8e4cd1ab9dd6002b379109045359d4f7e32ded1c722e28a3addbbd13eb182ec7e91af6bcae6b9536cb318994d60acda77ab6d9808963f7dd3fa
-
Filesize
1.5MB
MD5966580716c0d6b7eec217071a6df6796
SHA1e3d2d4a7ec61d920130d7a745586ceb7aad4184d
SHA256afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2
SHA512cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224
-
Filesize
1.1MB
MD5b848e259fabaf32b4b3c980a0a12488d
SHA1da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA256c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
SHA5124c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27
-
Filesize
10KB
MD57ed56139e35d6e09dfa7fa2d7f7f8ff9
SHA137d1f89d36b9391fabab53169f4fb08a6b6122b7
SHA25653f3217c9a6345a57c4ebb600727416e75bf80da21daba87a2fa594ca866313f
SHA51207a5ed1948bd596d5e71d638ac6a37ac295dfe390632b45029d52e03b417ac0b5fd182129673f8255814bd2ede8f4b5f3c9358c7a14e6d3856fa0bf6f2a62ea6
-
Filesize
9KB
MD538423f7ec74fcdc74dd906e479b0b176
SHA1e3e8c43e70cfedba32273808ff7d84349ab1cba2
SHA25670185326ef845b498d7722ce375139b5c56ddb94262a19a1557b2f1e42067083
SHA512c878a9f0b97745b492fd8823f942d74eb8159d9da7acd9904e385c1141187ddd02c2ee5a66ccbcdf99c413722ca1d0c41ee500bec2c7b213a91e0c852e8fe88b
-
Filesize
106KB
MD55eac41b641e813f2a887c25e7c87a02e
SHA1ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
SHA256b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
SHA512cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5
-
Filesize
84KB
MD5c5aa0d11439e0f7682dae39445f5dab4
SHA173a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA2561700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
SHA512eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5
-
Filesize
102B
MD5e7bf0f6a4cfac67dcd90c0088cc32e00
SHA150d74926ee6e3d3025a2033683e5cfd56bedecde
SHA2568fd022b2ccdadfbe742d01c5010c987ab3639a410e375fbcc3f45a64d16d292b
SHA5122f587ece802952038556afd14faf26f51f608521c569bc02a08b8e66428317178a7b94ca97a43a0e067fda5762cd158ff872c06cf38292e14dd86f9b2a9326ed
-
Filesize
5KB
MD5a8edb0d16121928e5737fc19c23487ef
SHA1e81bf0bbb1572a1f068c882bec324159eda2dce7
SHA256b920b15b9745b4eecf610ca82609562537bf6916057ce6afe438e73e4281cca8
SHA5122a220e2b66caa7ad68a42d425a233708153c9b522dd14895861f116e1dddc56a6a8e7c3f112039493643c7d6c61482afe52ad783ca5ef6d8777030817e961bb0
-
Filesize
70KB
MD59dbc1912d59cf70d79f3ee8125c5078c
SHA16f731d85638f37deba3a86caf13c63d99934c335
SHA256d94303c1e22045e7f31c54c970981b0ec5a0cbe4a5c8e61ac3600a0fa34ac263
SHA5120dd6084d49a05c557e3088e47ec2f409dcd8df59c026e747ded6b06cd86083e04400a7a69f1a033c6667721f1cca47149239c457b566757d58b871af2b4117b8
-
Filesize
6KB
MD57d0f2eb7be5a5e155cfdf002b2f59ed3
SHA19665811f759aa7477e138b8d7f61743bfa13b1b5
SHA2567b3e18ed8cb42ec347e943d8c9b7c67242e6ceeb5c2e1ed5222b1a8e015ae0ef
SHA5120a9a95387c5179ec57d58980fada33c00e6c012e30c2ac2f0c74c5841269c7f433b7c7658c0498456c9c4d1da22206723a753f4daaa4fb98f8b051f90554dd10
-
Filesize
28KB
MD5554dd47d51944440c9de0923af522281
SHA16517a03d4a733c6e3651ac13003dd02d53495321
SHA256dbeacaf5c1a782b82924b5b8d38a08de51b83509e84fe50dc33037529e3c6087
SHA51255bf58ec606615ef97af74325ad937d88446e16eda8758b73fbaf82972cbdd9ec6bc513997816336eae2e6a646f6af2cf7c50bcc2e1ecafadab142f089ac9823
-
Filesize
36KB
MD5b7d06f8d12abb37c240ab40724d0d4df
SHA121b6b0f027a55217ce0fba9612e80ca7f7e16c0e
SHA2560ba37877f243e1034c8cbc0f7483423855ae7f20f8bccedbe4ba51d8668731c6
SHA512ecf370ec1751049edf89d9a8b7da7daddd5b9d78400680b90599964a2cf222fd388d5864c3b232eef88254d02f70417b840b3a4f6d8e36cb60115291286f9aee
-
Filesize
14KB
MD547cf7f96114232ea550be6c447f18b9e
SHA165d90d0d2e454b2b852148ba197aa9fcf983b11c
SHA256307dc298aeb9f16a4dfeee7a18bf4257860c164cbd18b68a874080722c6432b0
SHA51222ec8a340e43ce4c7f8b29a5be39815365798d68e4e870c4f83b6f1eb13b67c825c8b8e3692886b85afde276f68ad361627e0c2a06f2c2d5f01499706352a929
-
Filesize
70KB
MD545dae59754b8225989ee269ab6f8a6ae
SHA15f829a3c9f77d532877195f0869ae9827d8a7f2e
SHA256f44d9800850b58766c0042dfa8b7f981da8befeb84f846e0e2ea8a81b4b25589
SHA5120f3d08b1541d16d68a824507244695ade755622ee3e19e9b9d0a45c8ad9be633d4f0a466032ecaf5dff18d8a6fdb58db82ced7a5f2e6e7fecf6ff9914080682d
-
Filesize
29KB
MD5b26a0fc90f172df1e3c69160c7bf3705
SHA195588f54b8bcc2ebfee93ece7d8ee407dac3bb70
SHA256ee01dd6e148a694a725e0382ec64aeb1374dee8250be318563fa3c0d0359d857
SHA51275a404b4cab4572cd0e60af2b4f7226f7d6f95e7a6add1c41e16062c59d7a04f0438cbddde7b4b45844e7bbf52eb86af068250f2e123af7275f24a4aee79813b
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\AdvancedOutputProcess1.gif
Filesize15KB
MD5adba3f0770aa6b2be5dd093a21d8f4d4
SHA1b395f7c7791f21e94e15af0cbc326a8a8784b93c
SHA2564228532374e1c6d1273e3434a99698178aca8f91b14b00df1607d49858ef70ec
SHA51206228148b7aa8a5da3870f303ccd1efb98606f4b30fdd69e6c6ba6d9a85234d748cf7f442a68b27ebbdd134aaa68fe4f0e0997b3d4452e260d1b31efb33bb4a5
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\AdvancedOutputProcess2.gif
Filesize1KB
MD5eebaaa21bef15dcc53f72a9d06334205
SHA1b25986600f1216bd3128e26cf0dcbb2200093e8c
SHA256a8fd3d25ed315b0493d42a00b3d042cbbfefaba381ebda299daf247a34e59f9d
SHA512d79302eaead7010bc9c011dc09de6f85b9fdd822e5e95c7c0b2b7a24f0985ef6bbb0c870c27017d22129f019cff5b08ae3dff371f70196761b22a821e3bfba35
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\AdvancedOutputProcess3.gif
Filesize1KB
MD5636dd27047636dd4c732fd2c43eca577
SHA1052d019bafe2feeae33778698cf038de0eba2a62
SHA256e1686805b1217a2cd47597ecfe91440461809bd6a87adc37b4986070d8152326
SHA51273b45abd52719203bdaca93384de31e4c8faca3560f115d1f29584acbf32ab74551ba2ce2dae158261c60082fda8db4427609790ae614dcae23a2ba813c98946
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\AdvancedOutputProcess4.gif
Filesize14KB
MD5b912f8d0e7e82f8051645db22e1718f8
SHA1f05e2d5cf63641b57b581655f53a11e803ff6b1e
SHA2569be81424d3a7e80b974fb169285e87451f00eb2b56a2b63d634ecddae65a4884
SHA5126f550978df44f61de8b17db57e511a97ae02f17f164fec79765649622b530a381dfd4926bca7dbd7e4ebec4e6be212f4d5c210c1c2eb0ed740e625d03369be8a
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\AdvancedOutputProcess5.gif
Filesize16KB
MD5600388c07d13dfb15ef658f816fd4645
SHA1e959a774bc9666f1e0657047fb149e106107bb86
SHA2561828bd2865088504c583e1cb127a7618482b9d097cff629fb52dcdfd492e107f
SHA5121f3bd51b34e60ab3f12c57bf519b3cf8b7e1dfb4a0ffcce6ecf1003774edf063c0c35f782aff8a83ffcc0ca6747c1650cb5924937d69f0dc52dc40bfe5deaa21
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\AdvancedOutputProcess6.gif
Filesize33KB
MD5dfc10fa9454a0f2606861233148e6de3
SHA19e15265f7f8c8b295fa2a1269afea7323cb4050c
SHA2569f357f334268038683c86c297bc956a1415de5cd4f2be5b1508fa517c5b37d04
SHA5125694109d476c25308d45febab6dd26b02316414883406cb8ebac65485b82fc19828589cfb368df9ae4967b915a7087c4675edd4f257fd8e31bab6368459f8d78
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\Bagic-INPUT-resultscreen.png
Filesize5KB
MD50bbaac5566c18793dcccf623ee80500d
SHA1342b6cf353b87c2934543d0316cfb5c4ef09431f
SHA25644365bc6d57214c25775903cc28b92c892635dfd8c4365984c1cd5a2db031fcf
SHA5127076f14891751a6c5e1eafd9639c42a6511fb8b5478a83586e5522dbda8659156b6a3429de5810ad652e1c70187fd51b9c9160fc28ffda19c00924450b5d63ae
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\Bagic-INPUT-sourcecode.png
Filesize75KB
MD57b215d675f387f44cd13472dc9aedae7
SHA1f983481f3558df8dac2f0f2c291cc6642952c738
SHA256dc5d9cdc09eb6af1a0b1133168d5e569e932aab84c976730632489c618fb2f40
SHA5122f6435f0ddd0d7cfd7416ee0e54d57453aa2761180db4fe5d80f3a737132404e8a864e7ba7c0d1f14b728e3886667ebf64c513f0655d4e277a14973792b6e875
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\Bagic-PROCESS-resultscreen.png
Filesize5KB
MD5cd44e5abac9b8032c09b1669337fd543
SHA17cbf9c7831ae49544d50561909d89c4f91215d38
SHA256850d66e92d71857a5c69fd20e74551a0e6a09ac89966951e381c7b4201bb2eab
SHA512971738dd04b0e575eb747c86a4356e798aa44e16e4a6578e25b5d26bdf3723556a48e5d7d877d2f5750af6037f553679b05cee16c4b976c0aca47b0fea21db23
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\Bagic-PROCESS-sourcecode.png
Filesize64KB
MD5fba173e851fece3aaf660abc411ddfb4
SHA1b2e7e3760470ac367e69312cf29c01145a9d6e3e
SHA256be3d03eb0ad714d8c81ca991159ae5b591f89c7e75cc6e984b2f78203d9f5a8b
SHA5121cb26ed2ba252fe0d4695e7979329a276dbff678f085c2ded1029bc64652e3d0aa32f2b0535e2c685d2c3a88f1f3285b78d4a910e0f242ce6ebe47cd438e5194
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\Bagic-ouput-result-screen.png
Filesize4KB
MD5d54376a344c2b02cb9a05fda12d8f555
SHA1331191c686c8caba148a4bdfbbbac8fc3a0a4596
SHA256220d6f29ccccfa5d1e6ed7636041ddc1c26eaadf08a325222be4403440b4eb99
SHA5120c6c3e3b159a3984b724b60968cd7fbda0091e5a554b0bbb3713d580295f2781504e624438fe471424dd02297d7d48c7c8d132dcc6febdf8c35b773faec1805a
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\Basic-ouput-sourcecode.png
Filesize56KB
MD5c984437714c5f53e1977ccc98c763312
SHA1d782959e446350910904e046d421814ab869a0fd
SHA25607a3958ef3ad036670884c09c9890ad7eb6c1b2375df2f0ef6496cd4e62fcd3a
SHA5122a55c9da58237b7bc2ab851141d28b75af691b14ba08b58813638e5fe2d739cee15b878b3e0374c9a6434b22c0c503d4807992999c32b35ec846f7d67101a732
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\docs\generated\_images\introduction-Battleship.png
Filesize161KB
MD53a28b16ca9b6983cf5001c7201fd1b54
SHA1210b94d53f345185d4ecc5a0b3c5614d1d3779bb
SHA256ea21c486aa3f1e75d17e642ff72ae260c737757f10d93c066d218341110590de
SHA512e90bd7300046ee9404f3925c631b44cbb7b262db8a8f181ca28d340e4b5e6e33acc682dd96cf1a2790d1d342197f4e77cadc52c905745f036b7299cc8a073f02
-
Filesize
30KB
MD53435fe6861d415b65f61fe4db43e127a
SHA14d5b2c1befb11521dbac59db01d73c0118c2614a
SHA256384323152cd073cbc92d0af251d929ee52770e1230ff2128e7ee679b6bc17ebb
SHA512b08a1f781a8914570e0f761779440ab2bae50708abe29e37b0f31c880359aa46c253d339de28ca2e855bcb468d87639d1660d6baee5e727072d4725b27894dd7
-
Filesize
132KB
MD5b2d603552e2d3148cf2cf857fe4477d2
SHA1082f263274cba2e947382cdc71abe5c5bf33cb41
SHA2563388a864cca34769fba50229f14846455e26d95feb717242ba8e6553757bc86c
SHA512ae0797a9ebc2db03670ae134a065386db1bd83368678a2b242fe07f93fe824995f56def34cb5f60e91d5ebedcdc711570e191c705ac75ad4e6011bacfc23f030
-
Filesize
131KB
MD5a49bc4418e08a9da2edac3187d8a4945
SHA15a1476e1a612d35932e74f6d30d744e40d46747b
SHA2564011020546a5247444c5785fee7b7e429b1572ef4b4374520185554b4e005f73
SHA5126baad0816c6fba268326b6b65d70cc0c187403cc81934013a3efbf38c93bcb4a7b20ca52c6e4bea21f03198c5779ec333fc7109f76d21fabbd3b3a48f8f46591
-
Filesize
128KB
MD52ec667ec466133a70bcf8a6e30ec6e1e
SHA12fdd2bddd178166c067a6054c2f747e063c0cfa5
SHA25625cd4bcf8ee96379878c414dcd05d5f60c7ea255146021ae158aeeb6771a4d71
SHA512d2899bc8df0f8bf904093f22ff7b6d9125eeb418a4919571ab400cda00735dc67a64f7e8f49f599f501c854305eef81e3085621b30f06a2628bb10895ace9343
-
Filesize
175KB
MD5e05e1400eed2473f3ba52da8aae2b38e
SHA1a70c04af865c171f11528d1e45ad44e8fda616e9
SHA2562e06ecc05720eb8eda9520b949ac033c7f7ac6e4cc71698ca9503a66fb362b74
SHA512f13c20b72929028a06306dce72830b0017e5af19a1b034721ed2efd4948fc4c83a3e4c17d957f14bef1da4e8fde6ab406895f8954bfaa01eb06619d34f82467f
-
Filesize
175KB
MD55e41729f3d00b996df08cf22f87024e6
SHA1b3f9b72a5df76011459be5727a34b44f2a00fadf
SHA256f60a3958c8801387d312607dc3ecdab447d1386975214589181a4aa0bab2fb05
SHA5121e700531cafa6a125446b3eb3a0fce3d1827373a78d24b8ec1ae36f9dc410be981d34f46667f75587c96cd2408db91fbaee5a25cdcad84a4860978c066895040
-
Filesize
14KB
MD5fdb88b7c800f898316e1b170484c3f6d
SHA199180405fcb6aa3adb2e3868e93d7deb7961a936
SHA2560573e4dce91259d4a4aa3324090d43b795a3c597dbe338f87368abf54f7f63b4
SHA512166cede4a92928320591fa5009aa775fa48df34673428568377bd721e15f67effa1bd8c01b8174f421c5e0e04cc0cd858857f5ee558c33c22eab73bf1f83e7de
-
Filesize
57KB
MD50e9c66c15979a1a2a3b32b54baf886fb
SHA1508b38b4bfa8d7e544e5ed63f4c6f2c22aadb629
SHA256e5e4da03a0257a1ce0d12b9448415aeee38d25efb4587b6111734a3e3ef98f9a
SHA51274232232997a30805b9654ae65d697ce333cf9ca06ec38a956c29f1de4ef3479a6e81e054f065147e34103f6339e7b783324816321165068cf9672ce779847a4
-
Filesize
129KB
MD5091133110c7050850316b13ea152a73c
SHA1f707ad40877bef1d768444f36d63bdc4fd351725
SHA2569eb67a1517ade1dc25bc0ef139179808fd90c3219e6e4d2254969215bb693a13
SHA512f7a84475d12606a4e1379f473a4048358ffe1e89e5121c7d56bb703a1fdd64369b59e447e43562278a9fe30f1cefd6a4bb963f13f11b83a8743819b7b682a089
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\tests\run_tests__tests\everything\incomplete_todo_test.py
Filesize909B
MD5db3df9c49a3c3b453977fb3d9060c0ca
SHA1c1eeebc390106c330cc376141fbe5637f6af72fd
SHA256ef59b2799b457ab618dab07e8fad25e4bb73dc58910ae391e1ebc55ed2470b7e
SHA512fa7fd9d152274bfe9e9dbe0c1290f3cb680ae4e715565057aae7e178c09cd2d001884268c5df1c98fce90a4021de8394499fa84c7f4f55ce4f818192e2221d5f
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\pygame\tests\run_tests__tests\everything\magic_tag_test.py
Filesize859B
MD5b94d1d3a80522d74ab182e8ae233289c
SHA1a13f1a308829248199d0afd2ae868a0d90d3eab5
SHA2564a320a07feda2df19d8a1f1ca2d437e26d4a6d210823fd70190501c2b59e2326
SHA5127fbf6b47f9987c803fb29eeadad964f2d65b00228ea9260e0ad13dba532129f25e29aac4e36befe898aa987621ca031a4bd3f57da10d7b17fde816c192b67135
-
Filesize
1KB
MD5f0e423eea5c91e7aa21bdb70184b3e53
SHA1a51ccdcb7a9d8c2116d1dfc16f11b3c8a5830f67
SHA2566163f7987dfb38d6bc320ce2b70b2f02b862bc41126516d552ef1cd43247e758
SHA5128be742880e6e8495c7ec4c9ecc8f076a9fc9d64fc84b3aebbc8d2d10dc62ac2c5053f33b716212dcb76c886a9c51619f262c460fc4b39a335ce1ae2c9a8769a8
-
Filesize
3KB
MD5b6daac02f66ac8403e9061881322babe
SHA19a94672ccfea06156a5f8a321cd0626cfd233ae8
SHA256cf675c1c0a744f08580855390de87cc77d676b312582e8d4cfdb5bb8fd298d21
SHA5129c6b7326c90396aa9e962c2731a1085edb672b5696f95f552d13350843c09a246e0bbf0ec484862dff434fa5a86de4c0b7c963958ade35a066b9d2384076dd47
-
Filesize
2KB
MD5d680b2881597974acd91750e5ab61010
SHA1e00ed2416b5ce21641e3946905504d62d536972f
SHA25648a51959582478352275428ceecd78ef77d79ac9dae796e39a2eaf2540282552
SHA512112172acb515b0712ac58d78898eb159580ada3dd3f16aabb37cb7a8d964f9e4badf2869a245927b83b208d56904831c0f04ed925c95dfcb705801734fb0c7ba
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\setuptools\_vendor\typeguard-4.3.0.dist-info\entry_points.txt
Filesize48B
MD5aeab5bcf8bf89a51c97c4cdf70578848
SHA12e9c1617560ab66431aab90700db901985293485
SHA256aa9ecd43568bb624a0310aa8ea05a57c6a72d08217ce830999e4132e9cea1594
SHA5122be73e99296df26a28835f91dd8bc50eb104af06a3c54666175faf322e0ad4620453db0388531c4113b052a92c1d2e4c3088e25af43cde42aa852cf7b0cb5b05
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\setuptools\_vendor\typeguard-4.3.0.dist-info\top_level.txt
Filesize10B
MD5004a2a8ce1ab120a63902a27d76bd964
SHA1a4e367ab40410598dadd1fc5f680ed7a176beb09
SHA256e33dbc021b83a1dc114bf73527f97c1f9d6de50bb07d3b1eb24633971a7a82bb
SHA5120d8ff9a43897ab390ab41afe5bac8bd38a68c2bef88e844e5b49bf70e3164b226975cc2717ae3dc3428d1cfbb0be068c243f104915fee1ffa58c23fbe76fdb89
-
Filesize
1KB
MD57ffb0db04527cfe380e4f2726bd05ebf
SHA15b39c45a91a556e5f1599604f1799e4027fa0e60
SHA25630c23618679108f3e8ea1d2a658c7ca417bdfc891c98ef1a89fa4ff0c9828654
SHA512205f284f3a7e8e696c70ed7b856ee98c1671c68893f0952eec40915a383bc452b99899bdc401f9fe161a1bf9b6e2cea3bcd90615eee9173301657a2ce4bafe14
-
C:\Users\Admin\AppData\Local\Temp\_MEI38762\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt
Filesize104B
MD56180e17c30bae5b30db371793fce0085
SHA1e3a12c421562a77d90a13d8539a3a0f4d3228359
SHA256ad363505b90f1e1906326e10dc5d29233241cd6da4331a06d68ae27dfbc6740d
SHA51269eae7b1e181d7ba1d3e2864d31e1320625a375e76d3b2fbf8856b3b6515936ace3138d4d442cabde7576fcfbcbb0deed054d90b95cfa1c99829db12a9031e26
-
Filesize
16B
MD5bcebcf42735c6849bdecbb77451021dd
SHA14884fd9af6890647b7af1aefa57f38cca49ad899
SHA2569959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
SHA512f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78
-
C:\Users\Admin\AppData\Local\Temp\_MEI43602\pygame\tests\run_tests__tests\print_stderr\fake_4_test.py
Filesize949B
MD5fcd21e4f5511c21bc1ebadc409948932
SHA1104068763bacc07c798b8aa6633a8310af4e0731
SHA256c56a48554a737af4ace1b55ecdee3c43d8e4673b2ce2ccddc3a78c3ab267655f
SHA51297885790bfe241049131d6e254c03824977ed7a546ed6038aa03115accdb696a6337e1634135ee5aa905166716b9c2182d447f3fc3a8c27e92f90474ef40112f
-
C:\Users\Admin\AppData\Local\Temp\_MEI43602\setuptools\_vendor\importlib_resources-6.4.0.dist-info\LICENSE
Filesize11KB
MD53b83ef96387f14655fc854ddc3c6bd57
SHA12b8b815229aa8a61e483fb4ba0588b8b6c491890
SHA256cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
SHA51298f6b79b778f7b0a15415bd750c3a8a097d650511cb4ec8115188e115c47053fe700f578895c097051c9bc3dfb6197c2b13a15de203273e1a3218884f86e90e8
-
C:\Users\Admin\AppData\Local\Temp\_MEI43602\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\top_level.txt
Filesize7B
MD50ba8d736b7b4ab182687318b0497e61e
SHA1311ba5ffd098689179f299ef20768ee1a29f586d
SHA256d099cddcb7d71f82c845f5cbf9014e18227341664edc42f1e11d5dfe5a2ea103
SHA5127cccbb4afa2fade40d529482301beae152e0c71ee3cc41736eb19e35cfc5ee3b91ef958cf5ca6b7330333b8494feb6682fd833d5aa16bf4a8f1f721fd859832c
-
Filesize
81B
MD524019423ea7c0c2df41c8272a3791e7b
SHA1aae9ecfb44813b68ca525ba7fa0d988615399c86
SHA2561196c6921ec87b83e865f450f08d19b8ff5592537f4ef719e83484e546abe33e
SHA51209ab8e4daa9193cfdee6cf98ccae9db0601f3dcd4944d07bf3ae6fa5bcb9dc0dcafd369de9a650a38d1b46c758db0721eba884446a8a5ad82bb745fd5db5f9b1
-
Filesize
5B
MD590b425bf5a228d74998925659a5e2ebb
SHA1d46acb64805e065b682e8342a67c761ece153ea9
SHA256429507be93b8c08b990de120298f2a642b43fad02e901d1f9ff7fabadce56fdf
SHA512b0826bebfd6b27c30c5ac7c1bbb86935618dc9e41a893025439bf70b19f46eca1678a210831938e982189ab565d1f69766a8348d65d867b870a73ef05fb54b53
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82