Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    20s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 06:04

General

  • Target

    93772e83bb06173d0e647e8bca3c5ed2c52b2a941c980ee683856f65e085609d.exe

  • Size

    3.3MB

  • MD5

    b2171406ffa17b1d144a2225f88a3f1f

  • SHA1

    549c858c23f6c3112bdb1dabb6cd45cf1ab825e2

  • SHA256

    93772e83bb06173d0e647e8bca3c5ed2c52b2a941c980ee683856f65e085609d

  • SHA512

    fc90c1336b9ef4134c888cf520d2aa60995fa849a70b64bc5b02ed0987d120bc2aa40d0410769be6893d31cdc430fd69c04465a1b102abee9a4cb62106ac330e

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlMkBBtjYV8Lt226E:c+8X9G3vP3AMnBtkV8Lt22X

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\93772e83bb06173d0e647e8bca3c5ed2c52b2a941c980ee683856f65e085609d.exe
    "C:\Users\Admin\AppData\Local\Temp\93772e83bb06173d0e647e8bca3c5ed2c52b2a941c980ee683856f65e085609d.exe"
    1⤵
      PID:2000
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1616
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3792
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:572
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2004
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3948
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4652
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3484
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4800
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3460
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:380
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4700
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:5100
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3000
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:764
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2632
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3756
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2512
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4836
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4416
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:2832
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:744
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2884
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:1772
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:4996
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1248
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3596
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:1424
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3836
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4428
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3544
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4912
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:1164
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:5100
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:1416
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:572
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2584
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3840
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3228
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1492
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:1060
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4384
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:1860
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:3324
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4304
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2448
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:368
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3848
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:4752
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2236
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:3420
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:1684
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:3804
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:2168
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:1832
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:4132
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:1960
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:212
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:720
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:2112
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:1548

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                471B

                                                                                                                MD5

                                                                                                                ecc3c9de4f6c2909d80c9a355c58a995

                                                                                                                SHA1

                                                                                                                205eb3c15c1e0338dee194e6b3de88fc61e8a503

                                                                                                                SHA256

                                                                                                                2d8dd41275cee7e1fc715eaab2e020c74e4d4640c5c7b25db31aa3a98519b966

                                                                                                                SHA512

                                                                                                                1e7138e5770573cf06796ffdd1811d9978c9d43dbfae2250c69b79b6a3b5d51b0f7e1e4c9fca5105629454586164e2c52b9624dbde93e21ebb69694a18a3bbd3

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                412B

                                                                                                                MD5

                                                                                                                2a333036e292b07e38545aff56d36390

                                                                                                                SHA1

                                                                                                                067144d130ada2d579fa68ffe8e8f106d23b9340

                                                                                                                SHA256

                                                                                                                cd10fe1201163da7cf54a7d2a07462e4942085da1d2243c569f4a74d7857a1d5

                                                                                                                SHA512

                                                                                                                626c9fecea5435cc8be1d479dfb501c0c6aea60b8510574b868c62727a904b4f761e6c13df4c9dd859c40c823d69cd35d9557c97d0bb1c544751e66328c8c28c

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                100b85d03c9a92f5de53e1f210dbd426

                                                                                                                SHA1

                                                                                                                f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                                SHA256

                                                                                                                f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                                SHA512

                                                                                                                b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                              • memory/212-346-0x00000243F5950000-0x00000243F5970000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/212-343-0x00000243F5340000-0x00000243F5360000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/212-340-0x00000243F5380000-0x00000243F53A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/368-277-0x00000179EFF00000-0x00000179EFF20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/368-274-0x00000179EFF40000-0x00000179EFF60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/368-279-0x00000179F0300000-0x00000179F0320000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/380-42-0x0000020465F00000-0x0000020465F20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/380-45-0x0000020466310000-0x0000020466330000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/380-40-0x0000020465F40000-0x0000020465F60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/572-204-0x000001C679620000-0x000001C679640000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/572-207-0x000001C6793E0000-0x000001C679400000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/572-209-0x000001C6799F0000-0x000001C679A10000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/720-355-0x0000000001550000-0x0000000001551000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/744-110-0x0000022CC5A40000-0x0000022CC5A60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/744-115-0x0000022CC5E00000-0x0000022CC5E20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/744-113-0x0000022CC5A00000-0x0000022CC5A20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1060-231-0x000001B7AC090000-0x000001B7AC0B0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1060-228-0x000001B7AC0F0000-0x000001B7AC110000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1060-233-0x000001B7AC6E0000-0x000001B7AC700000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1248-149-0x0000000003810000-0x0000000003811000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1424-163-0x000001B6D03D0000-0x000001B6D03F0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1424-157-0x000001B6CFFC0000-0x000001B6CFFE0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1424-159-0x000001B6CFF80000-0x000001B6CFFA0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1548-363-0x000001BB29BE0000-0x000001BB29C00000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2236-300-0x000001A4F60A0000-0x000001A4F60C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2236-296-0x000001A4F5C90000-0x000001A4F5CB0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2236-293-0x000001A4F5CD0000-0x000001A4F5CF0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2632-64-0x000001739B190000-0x000001739B1B0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2632-67-0x000001739B140000-0x000001739B160000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2632-69-0x000001739B5E0000-0x000001739B600000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2884-125-0x0000000004750000-0x0000000004751000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3000-56-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3228-221-0x0000000004080000-0x0000000004081000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3324-251-0x0000020BDC600000-0x0000020BDC620000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3324-253-0x0000020BDC5C0000-0x0000020BDC5E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3324-258-0x0000020BDC9D0000-0x0000020BDC9F0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3420-309-0x00000000041B0000-0x00000000041B1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3484-15-0x000001C858240000-0x000001C858260000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3484-17-0x000001C858200000-0x000001C858220000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3484-19-0x000001C8586B0000-0x000001C8586D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3544-182-0x00000166D06F0000-0x00000166D0710000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3544-184-0x00000166D0D00000-0x00000166D0D20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3544-180-0x00000166D0730000-0x00000166D0750000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3756-80-0x00000000040C0000-0x00000000040C1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3804-316-0x000001D899060000-0x000001D899080000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3804-319-0x000001D899020000-0x000001D899040000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3804-323-0x000001D899430000-0x000001D899450000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3836-173-0x0000000004F90000-0x0000000004F91000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3848-285-0x00000000043B0000-0x00000000043B1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3948-8-0x0000000004110000-0x0000000004111000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4132-332-0x00000000045B0000-0x00000000045B1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4304-266-0x0000000000960000-0x0000000000961000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4384-243-0x0000000003F10000-0x0000000003F11000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4416-102-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4800-33-0x00000000020F0000-0x00000000020F1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4836-89-0x00000179E7190000-0x00000179E71B0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4836-91-0x00000179E77A0000-0x00000179E77C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4836-87-0x00000179E71D0000-0x00000179E71F0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4996-133-0x0000024E58E80000-0x0000024E58EA0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4996-137-0x0000024E59250000-0x0000024E59270000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4996-135-0x0000024E58E40000-0x0000024E58E60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/5100-197-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB