Analysis

  • max time kernel
    18s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 03:12

General

  • Target

    2498b956d8d9a3b70901488ab67b6c17895e8373284298d45dfe83cf2fa41c01.exe

  • Size

    3.1MB

  • MD5

    d82fc969ba518381430596e219b36d28

  • SHA1

    91f3de1c04e3a42e43df4833ca81d946fada9015

  • SHA256

    2498b956d8d9a3b70901488ab67b6c17895e8373284298d45dfe83cf2fa41c01

  • SHA512

    26d018ed1a4adc1104bf39635c418d4353de10820c2934272406ae4ff7bb1752d2f995a56f0d901dd970c52e67a037d4cf5e2a1476d92425697812027d8cce28

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlzZb4rF1UGw/9IgrmLP+0Kt:Q+8X9G3vP3AMNheFeM5PM

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2498b956d8d9a3b70901488ab67b6c17895e8373284298d45dfe83cf2fa41c01.exe
    "C:\Users\Admin\AppData\Local\Temp\2498b956d8d9a3b70901488ab67b6c17895e8373284298d45dfe83cf2fa41c01.exe"
    1⤵
      PID:2756
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4400
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:2864
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        PID:2484
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3916
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4652
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2832
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3708
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:476
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4092
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4420
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1552
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:488
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3456
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:5028
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3852
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3788
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3668
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4136
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4212
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4928
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:404
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3128
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1400
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3340
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3416
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:1428
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2244
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:1484
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:1620
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:1400
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3268
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:5008
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3636
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2492
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3676
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:1716
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:5080
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:768
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4828
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4564
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:328
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:1756
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:3540
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:648
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2004
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3296
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4888
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4844
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4468
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3448
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3888
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:1792
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:4400
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:3496
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:1444
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:4056
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:3960
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:2436
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                    • Modifies Installed Components in the registry
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4652
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4308
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:4908
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:4424
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:328
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:4436
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:2724
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:3840

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                  Filesize

                                                                                                                                  471B

                                                                                                                                  MD5

                                                                                                                                  0085711bef17acad9eacf0bbf9bf3906

                                                                                                                                  SHA1

                                                                                                                                  20041eb81473c406da0ebfd7717231c0852ba344

                                                                                                                                  SHA256

                                                                                                                                  98c31705ae2dbde79cc8916db28c40c875597004ae24d94ac42433e0989d70a1

                                                                                                                                  SHA512

                                                                                                                                  3354239703701d843124bc466fd9794dd65ed766e4a1df64f784250292be3f24239a9e7156738d07a1c12316952cc1ee71ae9feba9b8fdbfb545e273ae871a6e

                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                  Filesize

                                                                                                                                  412B

                                                                                                                                  MD5

                                                                                                                                  ffbd09f6d5dabe5bfdbae5479599928a

                                                                                                                                  SHA1

                                                                                                                                  ff358c009bd06d9df82f1ca860c41a9f32c00cff

                                                                                                                                  SHA256

                                                                                                                                  94cdbe54a5eebc7eac21946ea06fad921f61d22b101d11c362a11f4fdcc1f4f8

                                                                                                                                  SHA512

                                                                                                                                  7092e26788f5aadf3c95183a7df4b40b72409436752187d52ba52f57a388b0f0d443369978a34eb0503d92eb8592c833131fcc7c014554c7eda018c2a8e5569f

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133415540040522707.txt

                                                                                                                                  Filesize

                                                                                                                                  75KB

                                                                                                                                  MD5

                                                                                                                                  62d81c2e1e8b21733f95af2a596e4b18

                                                                                                                                  SHA1

                                                                                                                                  91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                                                                  SHA256

                                                                                                                                  a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                                                                  SHA512

                                                                                                                                  c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133415540040522707.txt

                                                                                                                                  Filesize

                                                                                                                                  75KB

                                                                                                                                  MD5

                                                                                                                                  62d81c2e1e8b21733f95af2a596e4b18

                                                                                                                                  SHA1

                                                                                                                                  91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                                                                  SHA256

                                                                                                                                  a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                                                                  SHA512

                                                                                                                                  c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TEK1SANF\microsoft.windows[1].xml

                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  88e99175b1b7d310e0fbe53c60d388c3

                                                                                                                                  SHA1

                                                                                                                                  ac3c326df344a8240d9abf82eff3ef99eae6b430

                                                                                                                                  SHA256

                                                                                                                                  fea3a8d15530a744cbbd8c0b32672badcbd06fd19b2e311600c1bc016de37af2

                                                                                                                                  SHA512

                                                                                                                                  197b140abfc809b8da6348b2340ff93c06244a188f12ab0307877792597f36dbebc2c004ea1987c5b7dc5f9786f99a2201e655852c4e7ae6195400f1fe212154

                                                                                                                                • memory/648-218-0x0000026115390000-0x00000261153B0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/648-220-0x0000026115350000-0x0000026115370000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/648-222-0x0000026115800000-0x0000026115820000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/1400-134-0x000002EDE1A30000-0x000002EDE1A50000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/1400-131-0x000002EDE1530000-0x000002EDE1550000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/1400-128-0x000002EDE1570000-0x000002EDE1590000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/1484-120-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1716-177-0x0000019D40890000-0x0000019D408B0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/1716-174-0x0000019D40400000-0x0000019D40420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/1716-171-0x0000019D40440000-0x0000019D40460000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/1756-211-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1792-258-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/2244-109-0x00000245FE710000-0x00000245FE730000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/2244-107-0x00000245FE070000-0x00000245FE090000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/2244-105-0x00000245FE0B0000-0x00000245FE0D0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/2492-163-0x00000000040B0000-0x00000000040B1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/3128-84-0x000001BCC4630000-0x000001BCC4650000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3128-81-0x000001BCC4690000-0x000001BCC46B0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3128-86-0x000001BCC4CE0000-0x000001BCC4D00000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3268-140-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/3416-98-0x0000000004110000-0x0000000004111000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/3496-271-0x000001A347E00000-0x000001A347E20000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3496-269-0x000001A347760000-0x000001A347780000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3496-266-0x000001A3477A0000-0x000001A3477C0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3636-151-0x000001FAA2700000-0x000001FAA2720000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3636-148-0x000001FAA2740000-0x000001FAA2760000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3636-153-0x000001FAA2BB0000-0x000001FAA2BD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3668-51-0x0000000004530000-0x0000000004531000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/3788-40-0x0000019AB2180000-0x0000019AB21A0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3788-35-0x0000019AB1B10000-0x0000019AB1B30000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3788-38-0x0000019AB1AB0000-0x0000019AB1AD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/3960-283-0x00000000023A0000-0x00000000023A1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/4212-58-0x000001B1E5B00000-0x000001B1E5B20000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4212-60-0x000001B1E57C0000-0x000001B1E57E0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4212-62-0x000001B1E5F80000-0x000001B1E5FA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4424-304-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/4436-314-0x0000026269600000-0x0000026269620000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4436-317-0x0000026269A90000-0x0000026269AB0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4436-311-0x0000026269640000-0x0000026269660000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4468-242-0x000001C03B3F0000-0x000001C03B410000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4468-244-0x000001C03B3B0000-0x000001C03B3D0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4468-246-0x000001C03BA80000-0x000001C03BAA0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4652-293-0x0000025134A90000-0x0000025134AB0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4652-290-0x0000025134AD0000-0x0000025134AF0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4652-295-0x0000025134EA0000-0x0000025134EC0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4828-194-0x000002132FAD0000-0x000002132FAF0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4828-197-0x000002132FA90000-0x000002132FAB0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4828-200-0x00000213300A0000-0x00000213300C0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                • memory/4888-234-0x0000000004520000-0x0000000004521000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/4928-74-0x00000000044D0000-0x00000000044D1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/5028-29-0x0000000002E00000-0x0000000002E01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/5080-186-0x0000000004580000-0x0000000004581000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB