Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

984361c0d5cc5d_JC.exe

windows7-x64

8

984361c0d5cc5d_JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    33s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2023, 16:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    984361c0d5cc5d_JC.exe

  • Size

    3.4MB

  • MD5

    984361c0d5cc5d3d3894fbf52c85aff1

  • SHA1

    d9a5c83ef159e4393c5448aceb87d13454549567

  • SHA256

    6469ebfcdf3fdf69e16a31bd9809276daf7c0d19352418f81996fa0b51c165a7

  • SHA512

    24249baf9f084d7d336cc89a545fc8e9108024384ebc521a42dc9aace88ed42f948be23f83064f37190263be08ba0e2c385aa0005311ccf2f89ef1d7a310689f

  • SSDEEP

    49152:G9yiCJ5rFwnANZGEXep+9TxFegOSDAmosh3ANkTTlriYOgRbBEK:1J5rFwnApezgOS9V3AM5iArj

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 32 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\984361c0d5cc5d_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\984361c0d5cc5d_JC.exe"
    1⤵
      PID:4352
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1980
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1980 -s 6080
        2⤵
        • Program crash
        PID:4284
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1068
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 444 -p 1980 -ip 1980
      1⤵
        PID:1808
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2328
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2328 -s 5896
          2⤵
          • Program crash
          PID:3816
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3316
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 500 -p 2328 -ip 2328
        1⤵
          PID:4908
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3972
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3972 -s 5848
              2⤵
              • Program crash
              PID:3908
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:2268
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4124
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 4124 -s 3980
                2⤵
                • Program crash
                PID:5112
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 500 -p 4124 -ip 4124
              1⤵
                PID:1596
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 184 -p 3972 -ip 3972
                1⤵
                  PID:4180
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of SendNotifyMessage
                  PID:3528
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 3528 -s 7580
                    2⤵
                    • Program crash
                    PID:4180
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:4036
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:1892
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 1892 -s 3524
                    2⤵
                    • Program crash
                    PID:1272
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 524 -p 1892 -ip 1892
                  1⤵
                    PID:4844
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 412 -p 3528 -ip 3528
                    1⤵
                      PID:1080
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies registry class
                      PID:4652
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 4652 -s 6052
                        2⤵
                        • Program crash
                        PID:2184
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:3684
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 532 -p 4652 -ip 4652
                      1⤵
                        PID:1784
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:3676
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 3676 -s 5960
                          2⤵
                          • Program crash
                          PID:2248
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:3924
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:4208
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 4208 -s 3592
                          2⤵
                          • Program crash
                          PID:2200
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 184 -p 4208 -ip 4208
                        1⤵
                          PID:1532
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 580 -p 3676 -ip 3676
                          1⤵
                            PID:4692
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Modifies Installed Components in the registry
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            PID:2708
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -u -p 2708 -s 7560
                              2⤵
                              • Program crash
                              PID:2680
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3980
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4632
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 4632 -s 3588
                                  2⤵
                                  • Program crash
                                  PID:1956
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -pss -s 420 -p 4632 -ip 4632
                                1⤵
                                  PID:3992
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -pss -s 580 -p 2708 -ip 2708
                                  1⤵
                                    PID:2184
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4936
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -u -p 4936 -s 6072
                                        2⤵
                                        • Program crash
                                        PID:4552
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4200
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -pss -s 492 -p 4936 -ip 4936
                                        1⤵
                                          PID:4052
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3984
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 3984 -s 5080
                                              2⤵
                                              • Program crash
                                              PID:3324
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4008
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3928
                                                • C:\Windows\system32\WerFault.exe
                                                  C:\Windows\system32\WerFault.exe -u -p 3928 -s 3548
                                                  2⤵
                                                  • Program crash
                                                  PID:4552
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 584 -p 3928 -ip 3928
                                                1⤵
                                                  PID:3068
                                                • C:\Windows\system32\WerFault.exe
                                                  C:\Windows\system32\WerFault.exe -pss -s 592 -p 3984 -ip 3984
                                                  1⤵
                                                    PID:3988
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2340
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -u -p 2340 -s 6152
                                                        2⤵
                                                        • Program crash
                                                        PID:1508
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:1948
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:2424
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -u -p 2424 -s 3540
                                                            2⤵
                                                            • Program crash
                                                            PID:496
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -pss -s 184 -p 2424 -ip 2424
                                                          1⤵
                                                            PID:3908
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -pss -s 568 -p 2340 -ip 2340
                                                            1⤵
                                                              PID:2208
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2124
                                                                • C:\Windows\system32\WerFault.exe
                                                                  C:\Windows\system32\WerFault.exe -u -p 2124 -s 7448
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:1716
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3216
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1392
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 1392 -s 3588
                                                                      2⤵
                                                                      • Program crash
                                                                      PID:2848
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -pss -s 484 -p 1392 -ip 1392
                                                                    1⤵
                                                                      PID:4348
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -pss -s 572 -p 2124 -ip 2124
                                                                      1⤵
                                                                        PID:1484
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4528
                                                                          • C:\Windows\system32\WerFault.exe
                                                                            C:\Windows\system32\WerFault.exe -u -p 4528 -s 5844
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:2076
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:3980
                                                                          • C:\Windows\system32\WerFault.exe
                                                                            C:\Windows\system32\WerFault.exe -pss -s 604 -p 4528 -ip 4528
                                                                            1⤵
                                                                              PID:432
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4076
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 4076 -s 7388
                                                                                  2⤵
                                                                                  • Program crash
                                                                                  PID:2196
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:3424
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:4024
                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                      C:\Windows\system32\WerFault.exe -u -p 4024 -s 3588
                                                                                      2⤵
                                                                                      • Program crash
                                                                                      PID:2188
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -pss -s 580 -p 4024 -ip 4024
                                                                                    1⤵
                                                                                      PID:3476
                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                      C:\Windows\system32\WerFault.exe -pss -s 500 -p 4076 -ip 4076
                                                                                      1⤵
                                                                                        PID:4000
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:5004
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -u -p 5004 -s 3464
                                                                                            2⤵
                                                                                            • Program crash
                                                                                            PID:3736
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:4300
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:1988
                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                C:\Windows\system32\WerFault.exe -u -p 1988 -s 3628
                                                                                                2⤵
                                                                                                • Program crash
                                                                                                PID:3832
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -pss -s 524 -p 1988 -ip 1988
                                                                                              1⤵
                                                                                                PID:3268
                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                C:\Windows\system32\WerFault.exe -pss -s 552 -p 5004 -ip 5004
                                                                                                1⤵
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4124
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:4728
                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                    C:\Windows\system32\WerFault.exe -u -p 4728 -s 7504
                                                                                                    2⤵
                                                                                                    • Program crash
                                                                                                    PID:2064
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:3988
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:2928
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2928 -s 3580
                                                                                                        2⤵
                                                                                                        • Program crash
                                                                                                        PID:4860
                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 596 -p 2928 -ip 2928
                                                                                                      1⤵
                                                                                                        PID:1820
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 592 -p 4728 -ip 4728
                                                                                                        1⤵
                                                                                                          PID:4936
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:752
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -u -p 752 -s 6128
                                                                                                              2⤵
                                                                                                              • Program crash
                                                                                                              PID:3040
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:1272
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 560 -p 752 -ip 752
                                                                                                              1⤵
                                                                                                                PID:2092
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4952
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:2064
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:4292
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 4292 -s 3512
                                                                                                                        2⤵
                                                                                                                        • Program crash
                                                                                                                        PID:1288
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 584 -p 4292 -ip 4292
                                                                                                                      1⤵
                                                                                                                        PID:32
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:2676
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 2676 -s 3604
                                                                                                                            2⤵
                                                                                                                            • Program crash
                                                                                                                            PID:4572
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 492 -p 2676 -ip 2676
                                                                                                                          1⤵
                                                                                                                            PID:500
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:4072
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 4072 -s 3596
                                                                                                                                2⤵
                                                                                                                                • Program crash
                                                                                                                                PID:376
                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 604 -p 4072 -ip 4072
                                                                                                                              1⤵
                                                                                                                                PID:1300
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4156
                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 4156 -s 3948
                                                                                                                                    2⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:1416
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 604 -p 4156 -ip 4156
                                                                                                                                  1⤵
                                                                                                                                    PID:3292
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:2720
                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2720 -s 3564
                                                                                                                                        2⤵
                                                                                                                                        • Program crash
                                                                                                                                        PID:3888
                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 580 -p 2720 -ip 2720
                                                                                                                                      1⤵
                                                                                                                                        PID:4236
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:1392
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 1392 -s 3548
                                                                                                                                            2⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:4920
                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 532 -p 1392 -ip 1392
                                                                                                                                          1⤵
                                                                                                                                            PID:232
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:5112

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              24be707e4f2d742566674eaa854b21bd

                                                                                                                                              SHA1

                                                                                                                                              8d7a5482daf3aca5fe913961a85acdc2ce86a53e

                                                                                                                                              SHA256

                                                                                                                                              744917f62e796ac9b6004bec3b1cf73556944938614571ad540e501bbcf3a1ec

                                                                                                                                              SHA512

                                                                                                                                              146d3868ddf2e18eb53a405eb99e6679ffeaf47f257a080ea87f983a218531b280f11dcf3c6546cd403ab3aa1deff0ed2e8552ecd7b53d980a1ca8b74b75be42

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
                                                                                                                                              Filesize

                                                                                                                                              471B

                                                                                                                                              MD5

                                                                                                                                              c2074f204f8570d06776afc31aa2eb8a

                                                                                                                                              SHA1

                                                                                                                                              f9cf192e00946114f397eb5b8cb06e775f0ff0de

                                                                                                                                              SHA256

                                                                                                                                              5201aaa7d54fc211715a9c33276b5800f80dcfb81045367286c64b5305aaa655

                                                                                                                                              SHA512

                                                                                                                                              5a6897acf7a3acdbe51f6e6724fe0790b632e794ddc92ab6770fdcef6f46c448785d0f371c1774a08c7b8752da5340be386c9e25ae51c97fc5de251029d1e7a0

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                                                                                                                              Filesize

                                                                                                                                              404B

                                                                                                                                              MD5

                                                                                                                                              44a3d1d77b5f58e00b884321ec25a8fb

                                                                                                                                              SHA1

                                                                                                                                              8fbc8d71a0ded6df0c3752ec056844c7c403a557

                                                                                                                                              SHA256

                                                                                                                                              5b879f5c757bedf0777e85b3a348292caf97c721ed85d40cb5f66836f0265c9f

                                                                                                                                              SHA512

                                                                                                                                              ff6b190e9f258012bec9515b7fd5ed6f63fb01999106c3913a2694433a7ed437aec5dfbaf556327375f0adc74c9bb1c7703bb07277f528497a5a523c3e4bacfc

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
                                                                                                                                              Filesize

                                                                                                                                              412B

                                                                                                                                              MD5

                                                                                                                                              db860789d1e70eb7663fedaa734a2622

                                                                                                                                              SHA1

                                                                                                                                              8f8d2c7f81a15b08b73ffa760545fb92d4b3ad73

                                                                                                                                              SHA256

                                                                                                                                              81e5aa7afaa353b98942250bac9d245c8815937556cb91c2d4a1c5339aa42192

                                                                                                                                              SHA512

                                                                                                                                              f6825ead19a1949b3bbf6e187039ed2bb5692fcdc9c91512f422976747b3377b7d44d1ee419885147e49fbe44450cd2c7fe4dc2b0d3ad8e81071630776e8e090

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{0A6AC72E-ED8C-C16F-38B6-05831557CF24}
                                                                                                                                              Filesize

                                                                                                                                              36KB

                                                                                                                                              MD5

                                                                                                                                              8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                                                                                              SHA1

                                                                                                                                              231237a501b9433c292991e4ec200b25c1589050

                                                                                                                                              SHA256

                                                                                                                                              813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                                                                                              SHA512

                                                                                                                                              1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe
                                                                                                                                              Filesize

                                                                                                                                              36KB

                                                                                                                                              MD5

                                                                                                                                              94b56d65a8b7f7253aeacac345d4b096

                                                                                                                                              SHA1

                                                                                                                                              7e11e248ae804d3647479a4fe5f03835a1eee4bc

                                                                                                                                              SHA256

                                                                                                                                              0f312587a999305794730da6f2198c82a346e64211e2fb054256102ac70315be

                                                                                                                                              SHA512

                                                                                                                                              538cc0c1b4dc66e8a3c6ca9a17ddac128441874248589bcc6c88b64ad7d3b93ff143867d6fad0002cbb4584e951d0e82441c350396e6d59b73207a3ffe0fc055

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133340859640256963.txt
                                                                                                                                              Filesize

                                                                                                                                              75KB

                                                                                                                                              MD5

                                                                                                                                              22f39923e2942e5a02c3a5f91cefd45b

                                                                                                                                              SHA1

                                                                                                                                              c33909cb5ae1ad55b18b38b6aedf79c5a2216e13

                                                                                                                                              SHA256

                                                                                                                                              66457d8ac009ef25f44e676156bc058db582b2a3b431e2589435bb27477328c6

                                                                                                                                              SHA512

                                                                                                                                              17a2afe32e74150e58080055f3e67d3d4892828d9df28905a0e67227055b61eeab2a4764acf0b701bc481568fac2ccb889b326379319723fae838f8ce09e94fd

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133340859640256963.txt
                                                                                                                                              Filesize

                                                                                                                                              75KB

                                                                                                                                              MD5

                                                                                                                                              22f39923e2942e5a02c3a5f91cefd45b

                                                                                                                                              SHA1

                                                                                                                                              c33909cb5ae1ad55b18b38b6aedf79c5a2216e13

                                                                                                                                              SHA256

                                                                                                                                              66457d8ac009ef25f44e676156bc058db582b2a3b431e2589435bb27477328c6

                                                                                                                                              SHA512

                                                                                                                                              17a2afe32e74150e58080055f3e67d3d4892828d9df28905a0e67227055b61eeab2a4764acf0b701bc481568fac2ccb889b326379319723fae838f8ce09e94fd

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                              SHA1

                                                                                                                                              f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                              SHA256

                                                                                                                                              6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                              SHA512

                                                                                                                                              5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                              Download Submit

                                                                                                                                            • memory/1392-509-0x000001C8A0D90000-0x000001C8A0DB0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1392-295-0x0000029D0AAF0000-0x0000029D0AB10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1392-506-0x000001C8A0940000-0x000001C8A0960000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1392-293-0x0000029D0AB30000-0x0000029D0AB50000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1392-503-0x000001C8A0980000-0x000001C8A09A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1392-297-0x0000029D0AF00000-0x0000029D0AF20000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1892-181-0x000002CF1B980000-0x000002CF1B9A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1892-179-0x000002CF1B570000-0x000002CF1B590000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1892-176-0x000002CF1B5B0000-0x000002CF1B5D0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1988-341-0x0000020CE5380000-0x0000020CE53A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1988-343-0x0000020CE5790000-0x0000020CE57B0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1988-339-0x0000020CE53C0000-0x0000020CE53E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2124-285-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2340-262-0x0000000003720000-0x0000000003721000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2424-274-0x0000020DCC350000-0x0000020DCC370000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2424-272-0x0000020DCBF40000-0x0000020DCBF60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2424-270-0x0000020DCBF80000-0x0000020DCBFA0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2676-405-0x0000022106AE0000-0x0000022106B00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2676-407-0x0000022106AA0000-0x0000022106AC0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2676-410-0x00000221070C0000-0x00000221070E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2708-215-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2720-484-0x0000028AC6AF0000-0x0000028AC6B10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2720-488-0x0000028AC6AB0000-0x0000028AC6AD0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2720-491-0x00000292C8100000-0x00000292C8120000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2928-362-0x0000023C554D0000-0x0000023C554F0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2928-366-0x0000023C55AA0000-0x0000023C55AC0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/2928-364-0x0000023C55490000-0x0000023C554B0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3528-168-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3676-192-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3928-247-0x0000025356500000-0x0000025356520000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3928-249-0x00000253564C0000-0x00000253564E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3928-252-0x0000025356AE0000-0x0000025356B00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3972-146-0x00000000029F0000-0x00000000029F1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3984-239-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/4024-317-0x000002BE0A9C0000-0x000002BE0A9E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4024-319-0x000002BE0AFD0000-0x000002BE0AFF0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4024-315-0x000002BE0AC00000-0x000002BE0AC20000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4072-429-0x00000227BE510000-0x00000227BE530000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4072-431-0x00000227BE4D0000-0x00000227BE4F0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4072-433-0x00000227BEAE0000-0x00000227BEB00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4076-307-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/4124-153-0x0000027DB8730000-0x0000027DB8750000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4124-158-0x0000027DB8B00000-0x0000027DB8B20000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4124-155-0x0000027DB86F0000-0x0000027DB8710000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-469-0x000001C2E2780000-0x000001C2E27A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-465-0x000001C2E23B0000-0x000001C2E23D0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-467-0x000001C2E2370000-0x000001C2E2390000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4208-202-0x0000014A3C9E0000-0x0000014A3CA00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4208-205-0x0000014A3D0F0000-0x0000014A3D110000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4208-200-0x0000014A3CD20000-0x0000014A3CD40000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4292-387-0x000002B98DE60000-0x000002B98DE80000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4292-390-0x000002B98E270000-0x000002B98E290000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4292-384-0x000002B98DEA0000-0x000002B98DEC0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4528-304-0x00007FF9A1070000-0x00007FF9A109E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              184KB

                                                                                                                                              Download

                                                                                                                                            • memory/4632-225-0x000001A8ACF50000-0x000001A8ACF70000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4632-229-0x000001A8AD360000-0x000001A8AD380000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4632-223-0x000001A8ACF90000-0x000001A8ACFB0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4728-354-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/5004-332-0x0000000004830000-0x0000000004831000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download