Analysis

  • max time kernel
    25s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 11:49

General

  • Target

    b3459702dbe03b90e6784a3cf6512bd8dddc02e1b479999aeef7fea210d512b0.exe

  • Size

    2.8MB

  • MD5

    a53f037d3b3b8573dfe7bc8f26f8b000

  • SHA1

    1eddc3ac76fca81917afc0edcd6501dd3119f5e7

  • SHA256

    b3459702dbe03b90e6784a3cf6512bd8dddc02e1b479999aeef7fea210d512b0

  • SHA512

    d7ef663c58c6a1f72ee97a92bc738ce7c5929d701c2d57d92356f5e0e9b6252e9a369450042712ec53939c1460153f7fc5225f1b900774f1ed76a11571cb646c

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlve1GfzAFAIweAlY:Q+8X9G3vP3AMpxeAC

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3459702dbe03b90e6784a3cf6512bd8dddc02e1b479999aeef7fea210d512b0.exe
    "C:\Users\Admin\AppData\Local\Temp\b3459702dbe03b90e6784a3cf6512bd8dddc02e1b479999aeef7fea210d512b0.exe"
    1⤵
      PID:1144
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:348
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4856
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4392
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3472
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1316
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4920
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4104
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3988
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1284
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2884
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3260
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:224
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4208
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4104
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2256
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3620
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2188
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4364
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3424
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4880
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4516
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:5056
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4336
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:1312
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1340
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4228
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2136
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2664
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4992
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2644
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:2100
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:2896
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3028
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:1928
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3812
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4404
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:1996
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3468
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:2644
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:4376
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:1564
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:1472
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:3928
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:3776
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3244
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:3768
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:916
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1544
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3424
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:3940
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:1100
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3728
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:2396
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:1680
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:4720
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:5020
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:4940
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:872
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:3768
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4152
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3780
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:2540

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                      Filesize

                                                                                                                      471B

                                                                                                                      MD5

                                                                                                                      0085711bef17acad9eacf0bbf9bf3906

                                                                                                                      SHA1

                                                                                                                      20041eb81473c406da0ebfd7717231c0852ba344

                                                                                                                      SHA256

                                                                                                                      98c31705ae2dbde79cc8916db28c40c875597004ae24d94ac42433e0989d70a1

                                                                                                                      SHA512

                                                                                                                      3354239703701d843124bc466fd9794dd65ed766e4a1df64f784250292be3f24239a9e7156738d07a1c12316952cc1ee71ae9feba9b8fdbfb545e273ae871a6e

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                      Filesize

                                                                                                                      412B

                                                                                                                      MD5

                                                                                                                      2d71f4e70dd47ef073652cd27483a6f7

                                                                                                                      SHA1

                                                                                                                      2ff403d2bcf01d19ce8c871bb28ea2cbbc6f639c

                                                                                                                      SHA256

                                                                                                                      e51f0abd07e6c335448cc224f25b5e3d8d5469ddfb7c999457ee0256ad2d9483

                                                                                                                      SHA512

                                                                                                                      413a9af99802bef78ef6672f79f3647a49ab1408e6205a5f1e7c08b3f5c0171009886233a35ab578ff608a4327ab3323b7ba8959753dd8758e398ac64c6940fa

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                      SHA1

                                                                                                                      ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                      SHA256

                                                                                                                      fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                      SHA512

                                                                                                                      197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                    • memory/916-242-0x00000254A2F90000-0x00000254A2FB0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/916-246-0x00000254A2F50000-0x00000254A2F70000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/916-249-0x00000254A3360000-0x00000254A3380000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1100-273-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1284-12-0x00000000043C0000-0x00000000043C1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1312-86-0x000001B308C20000-0x000001B308C40000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1312-88-0x000001B3089D0000-0x000001B3089F0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1312-90-0x000001B308FE0000-0x000001B309000000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1340-98-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1472-214-0x0000000004570000-0x0000000004571000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1544-254-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1564-206-0x000001900A810000-0x000001900A830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1564-202-0x000001900A3C0000-0x000001900A3E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1564-199-0x000001900A400000-0x000001900A420000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1680-296-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2136-113-0x000001DBAA580000-0x000001DBAA5A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2136-110-0x000001DBAA170000-0x000001DBAA190000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2136-106-0x000001DBAA1B0000-0x000001DBAA1D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2396-285-0x000001F69EC30000-0x000001F69EC50000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2396-280-0x000001F69E7B0000-0x000001F69E7D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2396-282-0x000001F69E770000-0x000001F69E790000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2644-191-0x0000000002940000-0x0000000002941000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2644-133-0x0000020627430000-0x0000020627450000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2644-131-0x0000020627020000-0x0000020627040000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2644-129-0x0000020627060000-0x0000020627080000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2664-121-0x0000000004A30000-0x0000000004A31000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3028-145-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3244-234-0x0000000004500000-0x0000000004501000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3260-20-0x0000024241600000-0x0000024241620000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3260-18-0x0000024241640000-0x0000024241660000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3260-23-0x0000024241A10000-0x0000024241A30000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3424-59-0x0000000002710000-0x0000000002711000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3468-176-0x00000206036E0000-0x0000020603700000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3468-180-0x0000020603CC0000-0x0000020603CE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3468-178-0x00000206036A0000-0x00000206036C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3620-48-0x0000023C27040000-0x0000023C27060000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3620-45-0x0000023C26980000-0x0000023C269A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3620-42-0x0000023C269D0000-0x0000023C269F0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3768-329-0x00000233B3C50000-0x00000233B3C70000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3768-326-0x00000233B35B0000-0x00000233B35D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3768-323-0x00000233B3800000-0x00000233B3820000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3776-225-0x00000213BE450000-0x00000213BE470000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3776-229-0x00000213BEA60000-0x00000213BEA80000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3776-222-0x00000213BE490000-0x00000213BE4B0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3812-156-0x0000027AF8520000-0x0000027AF8540000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3812-158-0x0000027AF89D0000-0x0000027AF89F0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3812-153-0x0000027AF8570000-0x0000027AF8590000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3940-260-0x00000141E0260000-0x00000141E0280000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3940-263-0x00000141E0220000-0x00000141E0240000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3940-265-0x00000141E0690000-0x00000141E06B0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4104-35-0x0000000004000000-0x0000000004001000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4404-168-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4516-70-0x0000024FFF6A0000-0x0000024FFF6C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4516-66-0x0000024FFF230000-0x0000024FFF250000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4516-68-0x0000024FFF1F0000-0x0000024FFF210000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4940-315-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/5020-303-0x000002493D280000-0x000002493D2A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5020-305-0x000002493D240000-0x000002493D260000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5020-307-0x000002493D650000-0x000002493D670000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5056-79-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB