Overview

overview

8

Static

static

3

7ca1aa38ad...3c.exe

windows7-x64

8

7ca1aa38ad...3c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2023, 10:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7ca1aa38adb74a5f4e611b3388d95d320fd3f72305f4eec51b7a0aee2f45c63c.exe

  • Size

    2.6MB

  • MD5

    bf514a225362f6e36145111ecfe6d247

  • SHA1

    f8ec31d12591e7f433c426f38b4b761eb996e022

  • SHA256

    7ca1aa38adb74a5f4e611b3388d95d320fd3f72305f4eec51b7a0aee2f45c63c

  • SHA512

    900ae9bb25b89d3027f673cba13db51b1f130144b5f064c7f16045b88e18ffb3bccbcd05bdb74807c2e868137ccb24a1d199d92d81e3eb0b08826ce2910b24ec

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlSQQENGuAL2Gr:c+8X9G3vP3AMOENXdm

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ca1aa38adb74a5f4e611b3388d95d320fd3f72305f4eec51b7a0aee2f45c63c.exe
    "C:\Users\Admin\AppData\Local\Temp\7ca1aa38adb74a5f4e611b3388d95d320fd3f72305f4eec51b7a0aee2f45c63c.exe"
    1⤵
      PID:4528
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3856
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2156
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5028
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3956
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3816
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4012
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2112
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4324
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4484
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2176
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2248
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:3428
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3324
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2908
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3460
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4140
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3896
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4928
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4472
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2500
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4488
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3252
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4456
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3804
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4820
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3044
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:2820
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3332
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4408
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:1916
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1748
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3464
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:812
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                • Modifies Installed Components in the registry
                                                • Enumerates connected drives
                                                • Checks SCSI registry key(s)
                                                • Modifies registry class
                                                • Suspicious use of SendNotifyMessage
                                                PID:4484
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4328
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3456
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2664
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4520
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4020
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3448
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:760
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4036
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3264
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4360
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:736
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3240
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:3384
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:408
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2704
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4028
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4312
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:4004
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:2152
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4156
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4956
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:1692
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4744
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3628
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:380
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:5092
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3936
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:2372
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:3236
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:1116
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:5012
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:548
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:3096
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4616
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:1396
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:3448
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:3044
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:4584
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:2412
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:3076
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4728
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:3616
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:4536
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:1640
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:4036
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1132
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:3868
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:1124

                                                                                                                                              Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                Filesize

                                                                                                                                                471B

                                                                                                                                                MD5

                                                                                                                                                8e43b483e148c93026dd83487a7fa3c5

                                                                                                                                                SHA1

                                                                                                                                                98e775e71da8afd24b353b355803632c8b8b3522

                                                                                                                                                SHA256

                                                                                                                                                a2e935c525dfa460e4721c29bc07023d3a939e6e1127c00203a76435cd5ff254

                                                                                                                                                SHA512

                                                                                                                                                6edd33f99b8a802e50468334dbd9390929de53b755a4b646f9c6426d757344caad1562b552ca19dfb352306c600011196766b803b9c38d8a57094d135a68543f

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                Filesize

                                                                                                                                                412B

                                                                                                                                                MD5

                                                                                                                                                a38e0e19d940cd0b18793432f465d792

                                                                                                                                                SHA1

                                                                                                                                                c40009834dd3084443533a41c0dc922cf682955d

                                                                                                                                                SHA256

                                                                                                                                                533f86384272d09f138202fb74d1a0c9bed3d48757825f7334c99980c05125ce

                                                                                                                                                SHA512

                                                                                                                                                52b1c561ed2929f2e5de3c87172b443915e7f28419bc83cc29d9ee88f36075ed047a54f73c72ff5df620a27ca8e709defb79dc13fc78c19277ca4a83a4a467e9

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133407164688899482.txt
                                                                                                                                                Filesize

                                                                                                                                                75KB

                                                                                                                                                MD5

                                                                                                                                                62d81c2e1e8b21733f95af2a596e4b18

                                                                                                                                                SHA1

                                                                                                                                                91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                                                                                SHA256

                                                                                                                                                a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                                                                                SHA512

                                                                                                                                                c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                97B

                                                                                                                                                MD5

                                                                                                                                                82b066a0c26e9c3c026d421e012a093e

                                                                                                                                                SHA1

                                                                                                                                                2e4493ff239034dd93befa48a286616fa1222526

                                                                                                                                                SHA256

                                                                                                                                                a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                                                                SHA512

                                                                                                                                                4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                                                                Download Submit

                                                                                                                                              • memory/380-324-0x0000027839170000-0x0000027839190000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/380-319-0x0000027838DA0000-0x0000027838DC0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/380-321-0x0000027838D60000-0x0000027838D80000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/408-256-0x0000024C5F2F0000-0x0000024C5F310000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/408-254-0x0000024C5EBE0000-0x0000024C5EC00000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/408-252-0x0000024C5EF20000-0x0000024C5EF40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/760-220-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/812-180-0x0000021348880000-0x00000213488A0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/812-184-0x0000021348C50000-0x0000021348C70000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/812-182-0x0000021348840000-0x0000021348860000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1116-343-0x00000251D9300000-0x00000251D9320000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1116-345-0x00000251D8FB0000-0x00000251D8FD0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1116-347-0x00000251D96C0000-0x00000251D96E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1692-301-0x0000019E0B4D0000-0x0000019E0B4F0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1692-296-0x0000019E0B100000-0x0000019E0B120000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1692-298-0x0000019E0ADC0000-0x0000019E0ADE0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1748-173-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/1916-157-0x0000022D9C7E0000-0x0000022D9C800000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1916-159-0x0000022D9C7A0000-0x0000022D9C7C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1916-161-0x0000022D9CDB0000-0x0000022D9CDD0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2152-281-0x0000022AD6510000-0x0000022AD6530000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2152-276-0x0000022AD6140000-0x0000022AD6160000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2152-279-0x0000022AD6100000-0x0000022AD6120000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2248-47-0x0000027CF4530000-0x0000027CF4550000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2248-43-0x0000027CF4160000-0x0000027CF4180000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2248-45-0x0000027CF4120000-0x0000027CF4140000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2372-335-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/2500-105-0x00000000042C0000-0x00000000042C1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/2820-136-0x00000200BA190000-0x00000200BA1B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2820-138-0x00000200BA5A0000-0x00000200BA5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2820-134-0x00000200BA1D0000-0x00000200BA1F0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2908-68-0x000002268F490000-0x000002268F4B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2908-66-0x000002268F4D0000-0x000002268F4F0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2908-70-0x000002268FAA0000-0x000002268FAC0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3096-366-0x000001DB93980000-0x000001DB939A0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3096-368-0x000001DB93940000-0x000001DB93960000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3096-371-0x000001DB93D50000-0x000001DB93D70000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3240-244-0x0000000004310000-0x0000000004311000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/3252-117-0x00000203038C0000-0x00000203038E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3252-113-0x00000203032E0000-0x0000020303300000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3252-115-0x00000203032A0000-0x00000203032C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3264-228-0x00000222B9BE0000-0x00000222B9C00000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3264-232-0x00000222BA1C0000-0x00000222BA1E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3264-230-0x00000222B9BA0000-0x00000222B9BC0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3332-149-0x00000000041B0000-0x00000000041B1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/3428-58-0x0000000004750000-0x0000000004751000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/3448-205-0x000001BADF2E0000-0x000001BADF300000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3448-207-0x000001BADF2A0000-0x000001BADF2C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3448-209-0x000001BADF8C0000-0x000001BADF8E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/3896-82-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/3956-12-0x0000000004160000-0x0000000004161000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/4012-21-0x00000240DAFC0000-0x00000240DAFE0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4012-23-0x00000240DB5D0000-0x00000240DB5F0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4012-19-0x00000240DB200000-0x00000240DB220000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4156-289-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/4312-269-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/4472-95-0x000001F8B2E30000-0x000001F8B2E50000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4472-90-0x000001F8B2A60000-0x000001F8B2A80000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4472-92-0x000001F8B2A20000-0x000001F8B2A40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4484-35-0x00000000044B0000-0x00000000044B1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/4520-197-0x00000000033D0000-0x00000000033D1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/4744-311-0x0000000004830000-0x0000000004831000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/4820-127-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/5012-358-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download