Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/08/2023, 13:46

General

  • Target

    f3e2279343f31ddcaabb1eba6cf348423c3b3dd71c1df1981efed3fdb12fb3be.exe

  • Size

    3.4MB

  • MD5

    1620bc9b582a58141f1d264f4d304d21

  • SHA1

    bb1359d11ff3910f316fc522bc01d7c53e77a848

  • SHA256

    f3e2279343f31ddcaabb1eba6cf348423c3b3dd71c1df1981efed3fdb12fb3be

  • SHA512

    2ddf95787a2d416fd81299bf606413900a22291dea9fe6da4ca45007e27c36149a814abba7742c00dcdf9df3368fd547f355837973108247f0cbce3264cea0b4

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlszUnSBoNrWXqHnxSNE/QCfrgZ:c+8X9G3vP3AMSzDur6qRFQUrG

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 9 IoCs
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 18 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3e2279343f31ddcaabb1eba6cf348423c3b3dd71c1df1981efed3fdb12fb3be.exe
    "C:\Users\Admin\AppData\Local\Temp\f3e2279343f31ddcaabb1eba6cf348423c3b3dd71c1df1981efed3fdb12fb3be.exe"
    1⤵
      PID:2584
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2792
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2792 -s 6124
        2⤵
        • Program crash
        PID:736
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2288
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 420 -p 2792 -ip 2792
      1⤵
        PID:3880
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1656
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1656 -s 5968
          2⤵
          • Program crash
          PID:5000
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1532
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 604 -p 1656 -ip 1656
        1⤵
          PID:436
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4236
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4236 -s 4904
            2⤵
            • Program crash
            PID:2740
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1360
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4564
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4564 -s 3968
            2⤵
            • Program crash
            PID:2052
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 452 -p 4564 -ip 4564
          1⤵
            PID:4112
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 404 -p 4236 -ip 4236
            1⤵
              PID:3044
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Enumerates connected drives
              • Modifies registry class
              • Suspicious use of SendNotifyMessage
              PID:436
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 436 -s 7588
                2⤵
                • Program crash
                PID:3568
            • C:\Windows\system32\werfault.exe
              werfault.exe /hc /shared Global\61c9c2d8ab86490096788ff8bdad1c4e /t 1896 /p 4976
              1⤵
                PID:4060
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:4716
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4744
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 4744 -s 3976
                  2⤵
                  • Program crash
                  PID:4820
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 656 -p 4744 -ip 4744
                1⤵
                  PID:3520
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 600 -p 436 -ip 436
                  1⤵
                    PID:2760
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Modifies registry class
                    PID:1136
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 1136 -s 5988
                      2⤵
                      • Program crash
                      PID:4808
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1784
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 584 -p 1136 -ip 1136
                    1⤵
                      PID:1468
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Modifies registry class
                      PID:1372
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 1372 -s 5936
                        2⤵
                        • Program crash
                        PID:3704
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:4336
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 608 -p 1372 -ip 1372
                      1⤵
                        PID:3784
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Modifies registry class
                        PID:2692
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 2692 -s 5744
                          2⤵
                          • Program crash
                          PID:4084
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2512
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 624 -p 2692 -ip 2692
                        1⤵
                          PID:4032
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1836
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -u -p 1836 -s 6052
                              2⤵
                              • Program crash
                              PID:1668
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2396
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -pss -s 640 -p 1836 -ip 1836
                            1⤵
                              PID:2588
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Modifies registry class
                              PID:4984
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 4984 -s 7384
                                2⤵
                                • Program crash
                                PID:4764
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:3924
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:2772
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 2772 -s 3648
                                2⤵
                                • Program crash
                                PID:4444
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -pss -s 596 -p 2772 -ip 2772
                              1⤵
                                PID:3208
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -pss -s 560 -p 4984 -ip 4984
                                1⤵
                                  PID:4884
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3992
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 3992 -s 5928
                                      2⤵
                                      • Program crash
                                      PID:3588
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1528
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -pss -s 624 -p 3992 -ip 3992
                                      1⤵
                                        PID:1972
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        • Enumerates connected drives
                                        • Modifies registry class
                                        PID:1836
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 1836 -s 7420
                                          2⤵
                                          • Program crash
                                          PID:4628
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3316
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1120
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 1120 -s 3580
                                              2⤵
                                              • Program crash
                                              PID:3868
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -pss -s 608 -p 1836 -ip 1836
                                            1⤵
                                              PID:4508
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -pss -s 620 -p 1120 -ip 1120
                                              1⤵
                                                PID:1708
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:408
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 408 -s 5992
                                                    2⤵
                                                    • Program crash
                                                    PID:4032
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:2788
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -pss -s 632 -p 408 -ip 408
                                                    1⤵
                                                      PID:3748
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:2436
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 2436 -s 3980
                                                          2⤵
                                                          • Program crash
                                                          PID:2144
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4936
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -u -p 4936 -s 7496
                                                            2⤵
                                                            • Program crash
                                                            PID:184
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4516
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -pss -s 512 -p 2436 -ip 2436
                                                            1⤵
                                                              PID:1696
                                                            • C:\Windows\system32\WerFault.exe
                                                              C:\Windows\system32\WerFault.exe -pss -s 488 -p 4936 -ip 4936
                                                              1⤵
                                                                PID:1544
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4844
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3540

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    7e29d6af731e4c76cd85cf6ffe96ccdf

                                                                    SHA1

                                                                    fc578d2fd4e98240983d29b15cdadcbdf184f9ab

                                                                    SHA256

                                                                    e2e62bc3a34de7098f546612135ffc444368e2f6f4b072e04090065c3345426f

                                                                    SHA512

                                                                    7af640747e6562781299e30e9f5348b286b617a30177ee016280e60934c28163624e3b73e0f1116fc9e7f8511ca2fa3520e61215072b9c1fdf87bec81c583989

                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

                                                                    Filesize

                                                                    404B

                                                                    MD5

                                                                    1d41a77ceb31c9e05d430cceee33c1cd

                                                                    SHA1

                                                                    44369d45a178fc0ddccb6a579264e525d5867c97

                                                                    SHA256

                                                                    bad316a6b521dcc591055b752e47daf8f1277177eee3f4c6b7b7c6abd7658e67

                                                                    SHA512

                                                                    4fa5b81ee5d77a3a38616048b81569c218cb5112a98f584139d0a923b25430c9653b266d1fda550242dbebc78ba48e87900fdd642fe6acf22f5a540bd1cdf76f

                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml

                                                                    Filesize

                                                                    97B

                                                                    MD5

                                                                    402e0c5b12db3a5ffb0bece9995d459b

                                                                    SHA1

                                                                    f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                    SHA256

                                                                    6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                    SHA512

                                                                    5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml

                                                                    Filesize

                                                                    97B

                                                                    MD5

                                                                    402e0c5b12db3a5ffb0bece9995d459b

                                                                    SHA1

                                                                    f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                    SHA256

                                                                    6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                    SHA512

                                                                    5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml

                                                                    Filesize

                                                                    97B

                                                                    MD5

                                                                    402e0c5b12db3a5ffb0bece9995d459b

                                                                    SHA1

                                                                    f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                    SHA256

                                                                    6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                    SHA512

                                                                    5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml

                                                                    Filesize

                                                                    97B

                                                                    MD5

                                                                    402e0c5b12db3a5ffb0bece9995d459b

                                                                    SHA1

                                                                    f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                    SHA256

                                                                    6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                    SHA512

                                                                    5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml

                                                                    Filesize

                                                                    97B

                                                                    MD5

                                                                    402e0c5b12db3a5ffb0bece9995d459b

                                                                    SHA1

                                                                    f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                    SHA256

                                                                    6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                    SHA512

                                                                    5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                  • memory/436-28-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1120-92-0x000001DDD5590000-0x000001DDD55B0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1120-90-0x000001DDD5180000-0x000001DDD51A0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1120-87-0x000001DDD51C0000-0x000001DDD51E0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1836-79-0x0000000003F00000-0x0000000003F01000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2436-118-0x00000277BE7F0000-0x00000277BE810000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/2436-115-0x00000277BE3D0000-0x00000277BE3F0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/2436-114-0x00000277BE410000-0x00000277BE430000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/2772-68-0x000001D805CD0000-0x000001D805CF0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/2772-65-0x000001D806220000-0x000001D806240000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/2772-63-0x000001D805D30000-0x000001D805D50000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4236-9-0x0000000003F60000-0x0000000003F61000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4564-16-0x0000026A439C0000-0x0000026A439E0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4564-19-0x0000026A43980000-0x0000026A439A0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4564-23-0x0000026A43D90000-0x0000026A43DB0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4744-36-0x00000254FAE60000-0x00000254FAE80000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4744-42-0x00000254FB220000-0x00000254FB240000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4744-38-0x00000254FAE20000-0x00000254FAE40000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4936-104-0x0000000003890000-0x0000000003891000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4984-55-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                    Filesize

                                                                    4KB