Overview

overview

8

Static

static

3

64939a49b3...b8.exe

windows7-x64

8

64939a49b3...b8.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    62s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2023 14:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    64939a49b3908490d60d6fa532205126cb82b5209e050c1bc57e70b6f4cfc1b8.exe

  • Size

    3.2MB

  • MD5

    6c1e3b870fab7986bf6bc1f9935b4ddb

  • SHA1

    b1a19b228eb1d6c85b65f9625e8d1f5a9471007b

  • SHA256

    64939a49b3908490d60d6fa532205126cb82b5209e050c1bc57e70b6f4cfc1b8

  • SHA512

    af997e8769dc546bd2a2cd7bb19e19defb41891bdd1cf2ca271c7157bbc6b189f1ae0d35f900e4592f1008c5fde54d39095e83ee5d08e456b9e4be5c4de5dd1b

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlJZNgnlDC7R4HTsq+4:Q+8X9G3vP3AMzZ6lIeHYql

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\64939a49b3908490d60d6fa532205126cb82b5209e050c1bc57e70b6f4cfc1b8.exe
    "C:\Users\Admin\AppData\Local\Temp\64939a49b3908490d60d6fa532205126cb82b5209e050c1bc57e70b6f4cfc1b8.exe"
    1⤵
      PID:2252
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4476
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:460
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3892
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3216
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1184
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2440
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3044
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3056
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4624
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3296
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:2316
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1520
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3900
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2528
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1912
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:1468
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1880
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3816
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3204
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4280
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:1468
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:5020
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4380
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3520
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3652
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1228
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3220
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:1392
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4248
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4148
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4300
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:1136
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1812
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3460
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1228
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4004
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:4012
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:1156
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:4624
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2876
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2008
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4364
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4624
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:712
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4340
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1516
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3580
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1616
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:5056

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                        Filesize

                                                                                        471B

                                                                                        MD5

                                                                                        976ce2c91cbe61b98378e8e5c5ba4d53

                                                                                        SHA1

                                                                                        45b3e1eabb4e759bf46ffeb8f9722077a0d62c72

                                                                                        SHA256

                                                                                        255f312d16d7d080cf1a97d4eb255c236c7eee6c059d732d970e3c05c07c158e

                                                                                        SHA512

                                                                                        0065b7984960354aea85cd0c6792e019f40a2b359fabf7dcee438193c1bab47d74d59602627c8399df741864dffb0469d9cf8bc48907c1c67015c51d01a7b28a

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                                        Filesize

                                                                                        302B

                                                                                        MD5

                                                                                        dba623598db263dc5c7c4c873a98b5be

                                                                                        SHA1

                                                                                        629e3f0ad89ee407b24d5213be384da3e2f447b6

                                                                                        SHA256

                                                                                        30a2504fbfdcbb0cebd71f5794adab604cc8a331ff8cdc403ef331d76ca67a32

                                                                                        SHA512

                                                                                        6e0aa1856c156b2279b09e8ee313f282c1d63adaa2cffe140eac7b563c958d90fdfc52e35897e9cc8e550dc6c0fe1e8dfa4040eea29f7345f9bbcf87f0f59fe2

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                        Filesize

                                                                                        412B

                                                                                        MD5

                                                                                        5c6be2e705c73b8555ede6e7dfc7fd29

                                                                                        SHA1

                                                                                        81771fe4bcf5c778676ee0d41ba12d2843c5b033

                                                                                        SHA256

                                                                                        a6003911ba097275f7046bc2dc18790ee68086db88829018d7435b5375c804fe

                                                                                        SHA512

                                                                                        d898b69f18931cb5dd36f2976fbb8efe4ff547668673f1507299f6125f2c3d561a7dad92190d024b2bf569a6d97d6fd812dc4ed04c8472f37ccef2cb3820c531

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133415584373755693.txt
                                                                                        Filesize

                                                                                        75KB

                                                                                        MD5

                                                                                        62d81c2e1e8b21733f95af2a596e4b18

                                                                                        SHA1

                                                                                        91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                        SHA256

                                                                                        a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                        SHA512

                                                                                        c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                        Filesize

                                                                                        22KB

                                                                                        MD5

                                                                                        1e3aea3a289a84500572c41f00584107

                                                                                        SHA1

                                                                                        0b78428fa8fcea24923db3ffa290410d605f31b2

                                                                                        SHA256

                                                                                        9137448f352144543d634ab6378d0675ff0b5d77bbae2e2dc55ad8baf0a246ab

                                                                                        SHA512

                                                                                        c4f386b3572947fdf14b0a5a34e3243410f0b683043819147d1a95968364fb89023894d704b061a48483e703fc6bc1d3c96c8f1cdcb7dbde3fd2a5b8aa0eae88

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                        Filesize

                                                                                        22KB

                                                                                        MD5

                                                                                        1e3aea3a289a84500572c41f00584107

                                                                                        SHA1

                                                                                        0b78428fa8fcea24923db3ffa290410d605f31b2

                                                                                        SHA256

                                                                                        9137448f352144543d634ab6378d0675ff0b5d77bbae2e2dc55ad8baf0a246ab

                                                                                        SHA512

                                                                                        c4f386b3572947fdf14b0a5a34e3243410f0b683043819147d1a95968364fb89023894d704b061a48483e703fc6bc1d3c96c8f1cdcb7dbde3fd2a5b8aa0eae88

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        c31f790cfd02ef244af845fc39b43ad4

                                                                                        SHA1

                                                                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                                        SHA256

                                                                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                                        SHA512

                                                                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                                        Download Submit

                                                                                      • memory/712-275-0x0000014C0C790000-0x0000014C0C7B0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/712-273-0x0000014C0C2E0000-0x0000014C0C300000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/712-271-0x0000014C0C320000-0x0000014C0C340000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1228-186-0x00000000048C0000-0x00000000048C1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/1392-196-0x00000214A9BA0000-0x00000214A9BC0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1392-200-0x00000214AA1E0000-0x00000214AA200000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1392-193-0x00000214A9BE0000-0x00000214A9C00000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1468-88-0x0000025F13EE0000-0x0000025F13F00000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1468-93-0x0000025F144C0000-0x0000025F144E0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1468-91-0x0000025F13EA0000-0x0000025F13EC0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1812-222-0x00000185B4530000-0x00000185B4550000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1812-227-0x00000185B44F0000-0x00000185B4510000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1812-217-0x00000185B4160000-0x00000185B4180000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1812-220-0x00000185B4120000-0x00000185B4140000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/1880-104-0x00000000045A0000-0x00000000045A1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/2316-70-0x0000021C3E620000-0x0000021C3E640000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/2316-64-0x0000021C3DFB0000-0x0000021C3DFD0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/2316-67-0x0000021C3DF70000-0x0000021C3DF90000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/2440-36-0x0000000004140000-0x0000000004141000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/2528-80-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/2876-257-0x0000000004460000-0x0000000004461000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3056-50-0x00000236518D0000-0x00000236518F0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3056-44-0x0000023651470000-0x0000023651490000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3056-47-0x0000023651430000-0x0000023651450000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3204-113-0x000001D1D3770000-0x000001D1D3790000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3204-115-0x000001D1D3C10000-0x000001D1D3C30000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3204-111-0x000001D1D37B0000-0x000001D1D37D0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3460-234-0x0000000003260000-0x0000000003261000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3580-287-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/3652-174-0x000002F4BD6A0000-0x000002F4BD6C0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3652-171-0x000002F4BD090000-0x000002F4BD0B0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3652-167-0x000002F4BD0D0000-0x000002F4BD0F0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3892-13-0x00000291031C0000-0x00000291031E0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3892-15-0x0000029103910000-0x0000029103930000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/3892-11-0x0000029103500000-0x0000029103520000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/4004-241-0x000001B76B260000-0x000001B76B280000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/4004-243-0x000001B76B220000-0x000001B76B240000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/4004-245-0x000001B76B6C0000-0x000001B76B6E0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/4280-134-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/4300-209-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/4364-264-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/4380-160-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/4476-5-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/4624-56-0x0000000004390000-0x0000000004391000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                        Download

                                                                                      • memory/5020-146-0x000001E6600F0000-0x000001E660110000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/5020-142-0x000001E65FC80000-0x000001E65FCA0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/5020-144-0x000001E65FC40000-0x000001E65FC60000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/5056-295-0x0000028BF7140000-0x0000028BF7160000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/5056-297-0x0000028BF7100000-0x0000028BF7120000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download

                                                                                      • memory/5056-299-0x0000028BF7780000-0x0000028BF77A0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                        Download