Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    21s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 17:14

General

  • Target

    bf9667b1c01c543c0d8589df9a43812865029fdd20ab00653512416283e9296b.exe

  • Size

    3.5MB

  • MD5

    fb37096805eb1d0a34d4b496928b8602

  • SHA1

    129eb825ede5c9bccb915b2fd81b5acb2d133b5b

  • SHA256

    bf9667b1c01c543c0d8589df9a43812865029fdd20ab00653512416283e9296b

  • SHA512

    e47546322182c00742d8c5f9067071c0841dab503e8e77d62de4cc06907ad9042b0d99b1a7195904a32e73f4ca61855fa8f7984374862ba2ea9e20b59ce7b3d7

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlvMLmFJnKOMQuDuaYrZvAB:c+8X9G3vP3AMAmFJRqDuao+B

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf9667b1c01c543c0d8589df9a43812865029fdd20ab00653512416283e9296b.exe
    "C:\Users\Admin\AppData\Local\Temp\bf9667b1c01c543c0d8589df9a43812865029fdd20ab00653512416283e9296b.exe"
    1⤵
      PID:4164
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:232
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4752
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4648
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1612
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5104
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:4168
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4720
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4860
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2484
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3936
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3468
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4524
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:5096
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:1092
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:5108
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3932
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:1356
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4064
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3152
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4620
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3492
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4536
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4908
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1420
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4516
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4264
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3692
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:1392
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4620
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3324
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4236
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3944
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4740
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:808
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3412
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3700
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3904
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3812
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3480
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:5112
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3076
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:1412
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4796
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:5004
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:1928
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3884
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3228
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4248
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:1092
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:2756
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3812
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:2972
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:4028
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:2052
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:4608
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3656
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:760
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:1748
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4292
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3680
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:2032
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:684
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:1396
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:1696

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                            Filesize

                                                                                                                            471B

                                                                                                                            MD5

                                                                                                                            976ce2c91cbe61b98378e8e5c5ba4d53

                                                                                                                            SHA1

                                                                                                                            45b3e1eabb4e759bf46ffeb8f9722077a0d62c72

                                                                                                                            SHA256

                                                                                                                            255f312d16d7d080cf1a97d4eb255c236c7eee6c059d732d970e3c05c07c158e

                                                                                                                            SHA512

                                                                                                                            0065b7984960354aea85cd0c6792e019f40a2b359fabf7dcee438193c1bab47d74d59602627c8399df741864dffb0469d9cf8bc48907c1c67015c51d01a7b28a

                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                            Filesize

                                                                                                                            412B

                                                                                                                            MD5

                                                                                                                            36faa922db8d762a8500d6ee55421bba

                                                                                                                            SHA1

                                                                                                                            4c454d324125fa7cf90decd2acc21287897f171f

                                                                                                                            SHA256

                                                                                                                            5af8b00d8cbf7fffe66d3eb09cacb5a49c8123f8afdcea350010c273feb0b34f

                                                                                                                            SHA512

                                                                                                                            aa5541c0af5f9d53cc221d3a81bc97d9f0681b4a623e4aadf59317da339c73f07e23dd88f38af9803a035d30e93e489cf1d0b5853c0dc66e4d9fb476c186587d

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            97B

                                                                                                                            MD5

                                                                                                                            88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                            SHA1

                                                                                                                            ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                            SHA256

                                                                                                                            fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                            SHA512

                                                                                                                            197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                          • memory/684-318-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/808-156-0x000002DB7DF60000-0x000002DB7DF80000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/808-161-0x000002E37F3C0000-0x000002E37F3E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/808-158-0x000002DB7DF20000-0x000002DB7DF40000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1392-115-0x000002678BAD0000-0x000002678BAF0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1392-113-0x000002678B630000-0x000002678B650000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1392-110-0x000002678B670000-0x000002678B690000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1412-200-0x000002C3854E0000-0x000002C385500000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1412-203-0x000002C3854A0000-0x000002C3854C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1412-206-0x000002C385B60000-0x000002C385B80000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1696-325-0x000002079BBD0000-0x000002079BBF0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1696-328-0x000002079BB90000-0x000002079BBB0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1696-332-0x000002079BFA0000-0x000002079BFC0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1748-292-0x00000211151F0000-0x0000021115210000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1748-288-0x0000021115230000-0x0000021115250000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1748-295-0x0000021115600000-0x0000021115620000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1928-223-0x000002CED3360000-0x000002CED3380000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1928-221-0x000002CED2EA0000-0x000002CED2EC0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1928-220-0x000002CED2EE0000-0x000002CED2F00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/2032-306-0x000002C348860000-0x000002C348880000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/2032-309-0x000002C348820000-0x000002C348840000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/2032-312-0x000002C348C20000-0x000002C348C40000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/2032-316-0x000002C348BE0000-0x000002C348C00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/2756-244-0x00000213EFF00000-0x00000213EFF20000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/2756-246-0x00000213EFBB0000-0x00000213EFBD0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/2756-249-0x00000213F0350000-0x00000213F0370000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3480-177-0x00000151DD080000-0x00000151DD0A0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3480-181-0x00000151DD500000-0x00000151DD520000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3480-179-0x00000151DD040000-0x00000151DD060000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3656-280-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/3812-257-0x00000000044E0000-0x00000000044E1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/3904-169-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/3944-149-0x0000000003E90000-0x0000000003E91000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4028-270-0x000002796E240000-0x000002796E260000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4028-267-0x000002796DDA0000-0x000002796DDC0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4028-264-0x000002796DDE0000-0x000002796DE00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4064-59-0x00000000040C0000-0x00000000040C1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4236-133-0x000001F86BDC0000-0x000001F86BDE0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4236-136-0x000001F86BD80000-0x000001F86BDA0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4236-138-0x000001F86C230000-0x000001F86C250000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4248-237-0x0000000004410000-0x0000000004411000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4264-103-0x0000000004880000-0x0000000004881000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4292-299-0x0000000004230000-0x0000000004231000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4516-90-0x0000015A26C30000-0x0000015A26C50000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4516-87-0x0000015A26C70000-0x0000015A26C90000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4516-94-0x0000015A270D0000-0x0000015A270F0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4620-126-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4620-71-0x0000023C52810000-0x0000023C52830000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4620-69-0x0000023C52400000-0x0000023C52420000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4620-66-0x0000023C52440000-0x0000023C52460000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4720-15-0x000001FF58CD0000-0x000001FF58CF0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4720-20-0x000001FF59130000-0x000001FF59150000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4720-17-0x000001FF58C90000-0x000001FF58CB0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4796-213-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4908-79-0x0000000003F50000-0x0000000003F51000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/5096-34-0x00000000041C0000-0x00000000041C1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/5104-8-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/5108-42-0x00000286031E0000-0x0000028603200000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/5108-44-0x00000286031A0000-0x00000286031C0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/5108-47-0x0000028603940000-0x0000028603960000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/5112-192-0x0000000004580000-0x0000000004581000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB