Analysis

  • max time kernel
    25s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2023, 12:20

General

  • Target

    19ea14293f160488f6064c85201cb4e06334eedb00cfa236b1a80beaee034257.exe

  • Size

    2.8MB

  • MD5

    ac12f0d16057260e35af652edff8fc56

  • SHA1

    f327e734dc5a20b15486aef92981b5d0c4d0b387

  • SHA256

    19ea14293f160488f6064c85201cb4e06334eedb00cfa236b1a80beaee034257

  • SHA512

    064f4331d208238017356331f44ab3cc1d349b75736b5db0e5a52aedd6409f0a0597ffd40f4391ab0068997b402beba73aec1667ffdb2f2b2a0f9342b57cde1e

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlwpT0fTL:c+8X9G3vP3AMV

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 61 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\19ea14293f160488f6064c85201cb4e06334eedb00cfa236b1a80beaee034257.exe
    "C:\Users\Admin\AppData\Local\Temp\19ea14293f160488f6064c85201cb4e06334eedb00cfa236b1a80beaee034257.exe"
    1⤵
      PID:2716
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2212
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2156
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4964
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3436
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3704
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2652
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:1284
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3664
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:536
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4368
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4584
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3084
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4248
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2704
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:440
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2600
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:2888
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:928
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:5116
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4124
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4328
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:1192
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:2164
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:4208
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3760
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:468
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4112
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:3872
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1256
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:1064
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:1416
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4804
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3124
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3528
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:1772
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3712
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3132
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                      • Modifies registry class
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1284
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3744
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1796
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:684
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3860
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4136
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3368
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3688
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4744
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4432
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:1408
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4700
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:4300
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:4072
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:772
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:3728
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:652
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:1324
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:1480
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:4796
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:3516
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:4400
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:1408
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4164
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:1440
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:1668
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:4636

                                                                                                                        Network

                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                Filesize

                                                                                                                                471B

                                                                                                                                MD5

                                                                                                                                1a45b85bfabf0ea3977146d124cb7c60

                                                                                                                                SHA1

                                                                                                                                47abb6e5700a6b025d33cf276eac625e45f02a58

                                                                                                                                SHA256

                                                                                                                                513c25298482ef475b15ab35c2356f91642f6ba9ac95c1a97f379b42055fc0f2

                                                                                                                                SHA512

                                                                                                                                fe7f8a397bc4133887e5ea1661b6135b4c2ecfe9faaedac63a50c5795c60771c7050d62e99d66b53465e781f03007b12f49816b3b8a4804bf9fc91e5c1c80bd5

                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                Filesize

                                                                                                                                412B

                                                                                                                                MD5

                                                                                                                                396533c4a41339c138d0fbbd334abaa0

                                                                                                                                SHA1

                                                                                                                                e5ffe4f305f2163980d18507f037b615df264f9c

                                                                                                                                SHA256

                                                                                                                                eb37e887c317829134522ac39155f6147933d1430df5f35e9fd01fe65cf5fc51

                                                                                                                                SHA512

                                                                                                                                08529a180301e18d4b24b53ab7302a9c5aeae224564cb00d9275f1387f37cbc4b5409086e01936a3c6f98ea2f571809b33455054cdb443836a86fa42911237a0

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                Filesize

                                                                                                                                97B

                                                                                                                                MD5

                                                                                                                                88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                SHA1

                                                                                                                                ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                SHA256

                                                                                                                                fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                SHA512

                                                                                                                                197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                              • memory/440-52-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/468-104-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/652-248-0x00000200E3960000-0x00000200E3980000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/652-251-0x00000200E3910000-0x00000200E3930000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/652-253-0x00000200E3FC0000-0x00000200E3FE0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/684-186-0x0000026283490000-0x00000262834B0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/684-183-0x00000262834D0000-0x00000262834F0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/684-190-0x0000026283980000-0x00000262839A0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/772-240-0x0000000003220000-0x0000000003221000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/928-75-0x00000000028C0000-0x00000000028C1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/1284-160-0x0000028B65470000-0x0000028B65490000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1284-15-0x000001C826FD0000-0x000001C826FF0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1284-19-0x000001C8273B0000-0x000001C8273D0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1284-17-0x000001C826F90000-0x000001C826FB0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1284-163-0x0000028B65430000-0x0000028B65450000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1284-165-0x0000028B658D0000-0x0000028B658F0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1324-263-0x0000000002800000-0x0000000002801000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/1408-294-0x0000023351620000-0x0000023351640000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1408-298-0x0000023351A70000-0x0000023351A90000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1408-291-0x0000023351660000-0x0000023351680000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1408-301-0x0000023351950000-0x0000023351970000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1416-129-0x0000000004230000-0x0000000004231000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/1668-310-0x00000168114A0000-0x00000168114C0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1668-313-0x0000016811460000-0x0000016811480000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/1668-316-0x0000016811900000-0x0000016811920000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/2164-100-0x000001C0D33E0000-0x000001C0D33E8000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                32KB

                                                                                                                              • memory/2888-60-0x00000235A8490000-0x00000235A84B0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/2888-66-0x00000235A8A60000-0x00000235A8A80000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/2888-64-0x00000235A8450000-0x00000235A8470000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3084-44-0x000002B430F80000-0x000002B430FA0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3084-42-0x000002B4308E0000-0x000002B430900000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3084-39-0x000002B430920000-0x000002B430940000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3124-136-0x0000021EA7520000-0x0000021EA7540000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3124-139-0x0000021EA74E0000-0x0000021EA7500000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3124-142-0x0000021EA7B80000-0x0000021EA7BA0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3368-196-0x0000000004060000-0x0000000004061000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/3516-283-0x00000000044D0000-0x00000000044D1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/3704-8-0x0000000004F80000-0x0000000004F81000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/3712-152-0x0000000004620000-0x0000000004621000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/3744-175-0x00000000047F0000-0x00000000047F1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/3872-112-0x000002B093840000-0x000002B093860000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3872-117-0x000002B093CA0000-0x000002B093CC0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/3872-114-0x000002B093800000-0x000002B093820000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4072-233-0x0000021678B70000-0x0000021678B90000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4072-228-0x0000021678510000-0x0000021678530000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4072-231-0x00000216784D0000-0x00000216784F0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4124-88-0x00000163E9B90000-0x00000163E9BB0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4124-83-0x00000163E9500000-0x00000163E9520000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4124-86-0x00000163E94C0000-0x00000163E94E0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4164-303-0x0000000002F40000-0x0000000002F41000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/4328-98-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/4368-31-0x0000000002D70000-0x0000000002D71000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/4700-220-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/4744-209-0x00000217BA400000-0x00000217BA420000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4744-207-0x00000217B9F60000-0x00000217B9F80000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4744-204-0x00000217B9FA0000-0x00000217B9FC0000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4796-276-0x00000126F0110000-0x00000126F0130000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4796-273-0x00000126EFD00000-0x00000126EFD20000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB

                                                                                                                              • memory/4796-271-0x00000126EFD40000-0x00000126EFD60000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                128KB