Analysis

  • max time kernel
    19s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-10-2023 00:24

General

  • Target

    edd8c28d320ff6d50682e59e06d70433294466e9d784e1049bc3826dca1fcd64.exe

  • Size

    2.9MB

  • MD5

    85c63c174e33d0ffb36e352c6a456110

  • SHA1

    8a9395b56d8fc2eb17a6eda5b9d559e7a37f87bf

  • SHA256

    edd8c28d320ff6d50682e59e06d70433294466e9d784e1049bc3826dca1fcd64

  • SHA512

    0b9c48741a5c1b779dd7faef542637c99831ef7424de3406764abc3e522699de720fc7fc7e688299d57234790c4ecdc277ec242af7b23ada346dcec85f18d6c0

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTl03Twb4hwzRx:c+8X9G3vP3AMFkazRx

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\edd8c28d320ff6d50682e59e06d70433294466e9d784e1049bc3826dca1fcd64.exe
    "C:\Users\Admin\AppData\Local\Temp\edd8c28d320ff6d50682e59e06d70433294466e9d784e1049bc3826dca1fcd64.exe"
    1⤵
      PID:1312
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4612
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3592
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1752
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:516
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2620
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:4012
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:1380
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1892
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1468
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1336
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2232
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:2240
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3680
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2432
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4904
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3784
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2228
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3236
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4344
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4088
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:1628
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:5104
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:5000
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:2100
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1052
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3912
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4008
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3280
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2172
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4368
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3828
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:632
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3656
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:5012
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3628
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:416
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3432
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:1020
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:5104
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:3420
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:576
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4268
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2292
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:4860
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2900
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3420
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2356
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:1964
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:2984
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:952
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3520
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:2892
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3184
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:4344
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:3972
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:420
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:4568
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:1072

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                471B

                                                                                                                MD5

                                                                                                                f3409bd91920eb99f49a4db4bb6b755d

                                                                                                                SHA1

                                                                                                                e3e407489814c8945f0a127b1b2063ab2bc85105

                                                                                                                SHA256

                                                                                                                0f060af0d7f6005d221c3d36eea835f58f86f85eb0884b1a50409a1de3874868

                                                                                                                SHA512

                                                                                                                1834cc4bba00c96c3228b8f1624c4c57fb901503401b14073d73305a9a9cb5789abe1191646c480f42452958d2aec5ae43642c7b5c6a90aab59e52a9ae6f85e9

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                412B

                                                                                                                MD5

                                                                                                                682adbccc483767746fd3a9430299529

                                                                                                                SHA1

                                                                                                                5642f164bb872aa6aac2f951c06aa4fff652cc0c

                                                                                                                SHA256

                                                                                                                edce674992783b4ae5389ea0747b4dd4484a397e41ab6dcaad9d268783b0ee0f

                                                                                                                SHA512

                                                                                                                ba5361c2cc2b2a173a93f7a8be4545c9b100cc49c457e174b650742a98d0397926925a472d9c424a18814ca367dc40e7b77af1b31e389e9f3b0b797fa8298ba7

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                c31f790cfd02ef244af845fc39b43ad4

                                                                                                                SHA1

                                                                                                                947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                                                SHA256

                                                                                                                5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                                                SHA512

                                                                                                                135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                                              • memory/416-219-0x00000000042E0000-0x00000000042E1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/420-359-0x0000000004680000-0x0000000004681000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/576-252-0x00000161CF620000-0x00000161CF640000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/576-250-0x00000161CF660000-0x00000161CF680000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/576-254-0x00000161CFA30000-0x00000161CFA50000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/952-312-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1020-227-0x00000253D08C0000-0x00000253D08E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1020-230-0x00000253D0880000-0x00000253D08A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1020-233-0x00000253D0EA0000-0x00000253D0EC0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1052-147-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1072-367-0x00000242A2FE0000-0x00000242A3000000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1072-369-0x00000242A2FA0000-0x00000242A2FC0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1072-372-0x00000242A35B0000-0x00000242A35D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1336-32-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1380-16-0x0000024F2F780000-0x0000024F2F7A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1380-22-0x0000024F2FD90000-0x0000024F2FDB0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1380-18-0x0000024F2F740000-0x0000024F2F760000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1628-111-0x0000021925630000-0x0000021925650000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1628-109-0x0000021925670000-0x0000021925690000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1628-114-0x0000021925A40000-0x0000021925A60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2100-134-0x000001710E950000-0x000001710E970000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2100-132-0x000001710E990000-0x000001710E9B0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2100-137-0x000001710ED60000-0x000001710ED80000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2240-47-0x0000013A21900000-0x0000013A21920000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2240-40-0x0000013A21540000-0x0000013A21560000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2240-44-0x0000013A21500000-0x0000013A21520000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2356-289-0x0000000003570000-0x0000000003571000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/2620-10-0x00000000011B0000-0x00000000011B1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/2892-320-0x000002411A0B0000-0x000002411A0D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2892-322-0x000002411A070000-0x000002411A090000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2892-326-0x000002411A6C0000-0x000002411A6E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2984-301-0x0000014190160000-0x0000014190180000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2984-299-0x000001418FB50000-0x000001418FB70000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2984-297-0x000001418FB90000-0x000001418FBB0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3184-333-0x00000000044B0000-0x00000000044B1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3236-86-0x0000018706E90000-0x0000018706EB0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3236-92-0x0000018707460000-0x0000018707480000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3236-89-0x0000018706E50000-0x0000018706E70000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3280-176-0x00000000041D0000-0x00000000041D1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3628-206-0x000002A3D2220000-0x000002A3D2240000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3628-209-0x000002A3D2620000-0x000002A3D2640000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3628-204-0x000002A3D2260000-0x000002A3D2280000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3656-197-0x0000000004290000-0x0000000004291000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3680-55-0x0000000004880000-0x0000000004881000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3784-78-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3972-340-0x00000288DC300000-0x00000288DC320000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3972-342-0x00000288DBFB0000-0x00000288DBFD0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3972-346-0x00000288DC6C0000-0x00000288DC6E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4008-158-0x0000025483290000-0x00000254832B0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4008-160-0x00000254838C0000-0x00000254838E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4008-155-0x00000254832D0000-0x00000254832F0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4268-266-0x0000000004E80000-0x0000000004E81000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4344-102-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4368-186-0x000002DAD6B60000-0x000002DAD6B80000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4368-188-0x000002DAD6F70000-0x000002DAD6F90000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4368-183-0x000002DAD6BA0000-0x000002DAD6BC0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4860-278-0x000001F848FC0000-0x000001F848FE0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4860-275-0x000001F848BB0000-0x000001F848BD0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4860-273-0x000001F848BF0000-0x000001F848C10000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4904-70-0x000002A1F6BD0000-0x000002A1F6BF0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4904-66-0x000002A1F67C0000-0x000002A1F67E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4904-63-0x000002A1F6800000-0x000002A1F6820000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/5104-242-0x0000000004140000-0x0000000004141000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/5104-125-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB