Analysis

  • max time kernel
    15s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2023, 22:10

General

  • Target

    NEAS.2023-09-05_64db45b338d899651d0e26762af4c2fb_mafia_JC.exe

  • Size

    2.8MB

  • MD5

    64db45b338d899651d0e26762af4c2fb

  • SHA1

    048e2b0de0a5f288b4be300dd1524ca1c911eea1

  • SHA256

    9d12c0820f60d42d64ad6bf09a3e6044d2f3e21eed786bb104b6c1eef9c7f34e

  • SHA512

    032045e5b24e7a0c98dbb41dfdf417a6ed62a7151961b43cbe35f17d38f7ebc4b7115b215b6296ce56b4091be798899d2369493b4e6630d6942c6e643e8f69fa

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlLiDAiyKoM9C:c+8X9G3vP3AMOABPMQ

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_64db45b338d899651d0e26762af4c2fb_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_64db45b338d899651d0e26762af4c2fb_mafia_JC.exe"
    1⤵
      PID:4468
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4312
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2480
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:396
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3776
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4344
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:388
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3264
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4224
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3096
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:3396
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4940
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:756
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3964
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3024
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:5072
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4016
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3512
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:544
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:1492
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3024
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3948
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3208
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4816
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3732
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4228
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1028
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:752
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4560
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3104
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:2624
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4424
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4044
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3800
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1200
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2076
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4588
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:1296
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:3996
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4672
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2816
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:2012
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:752
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:4060
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4464
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:1308
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:1708
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3516
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:1860
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:988
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3852
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:3572
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3400
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3728
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:4836
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3776
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:4040
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:5112
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:3200
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:4156
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:1296
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:2576
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:2628
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:2792

                                                                                                                            Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                    Filesize

                                                                                                                                    471B

                                                                                                                                    MD5

                                                                                                                                    cf45755e2b0cc968e78fe845d3928a6e

                                                                                                                                    SHA1

                                                                                                                                    571c0ba8b935992f9cc56db08d8f0fbefa9c6f6a

                                                                                                                                    SHA256

                                                                                                                                    c8941381eda04ac7287e82b68abfe32078279d33dc03206d0c7b10aa63cd77da

                                                                                                                                    SHA512

                                                                                                                                    c31b65bf97ba7d8de4126f2ab953430cb920df9b8e0b9ca140db6d9c28d122c34a73937638f2d48fe4c7f9815d7ed86e121135cec7a9c36aba0648344ed457e6

                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                    Filesize

                                                                                                                                    412B

                                                                                                                                    MD5

                                                                                                                                    fc4c55c28074e0b6741de327851af12e

                                                                                                                                    SHA1

                                                                                                                                    54548405a9752c17c7a77a04c48e086868ceba99

                                                                                                                                    SHA256

                                                                                                                                    1374711e242645db4342ab854fa6c4b83690883a65e2d685e130bd1fa95d3d27

                                                                                                                                    SHA512

                                                                                                                                    b176a4444fb6e7458bb4bb989cef0766bbe349b586bf4b4751128b32e17e0de999a918cc1c27d9077e9975558489f008f63f9a76e6b2e8068bf95e6c35508744

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    aa5cd04471ba2fc2c5d8149b0068d7d4

                                                                                                                                    SHA1

                                                                                                                                    9615ae9d5ee9c667d78c942dcde63b6b94435f99

                                                                                                                                    SHA256

                                                                                                                                    a650b7c66768fa1cc257e19e6d1195f59ba4afb189602d4bf9c412eec9a8cc87

                                                                                                                                    SHA512

                                                                                                                                    2d8bc98a82998751a4c5a18c267f1b9c67ec955c444f2f1bd6433526ce2fc895a468c95e948b580def68f88ecbf13d9bee7a7f9504ca0de790de9588fcd74695

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133432638354775905.txt

                                                                                                                                    Filesize

                                                                                                                                    74KB

                                                                                                                                    MD5

                                                                                                                                    0770cd8fe6784708d08860d93a5cb762

                                                                                                                                    SHA1

                                                                                                                                    ec3a74a70a55ac4e73f6ccaf01a7f4b86ca45cf8

                                                                                                                                    SHA256

                                                                                                                                    77c4ad43697c8de81a391a842311a1331fb37da159dcfe94eaa23e193479b1c2

                                                                                                                                    SHA512

                                                                                                                                    40c0c9f1e3a29320f68248439afe28ab00eef45b3dfbb9a3cc743a2f83374e6c2e8f36c57131a2c1b840c9f99b6c58b29f40ed453b03cd16607745fedae8e511

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                                    Filesize

                                                                                                                                    96B

                                                                                                                                    MD5

                                                                                                                                    25b98f558f0ca5ad449151322b6034e1

                                                                                                                                    SHA1

                                                                                                                                    ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                                    SHA256

                                                                                                                                    bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                                    SHA512

                                                                                                                                    2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                                                  • memory/396-8-0x0000000004240000-0x0000000004241000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/544-86-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/988-258-0x0000028DD3D60000-0x0000028DD3D80000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/988-261-0x0000028DD3D20000-0x0000028DD3D40000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/988-263-0x0000028DD43C0000-0x0000028DD43E0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/1296-307-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/1708-240-0x0000016C16A80000-0x0000016C16AA0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/1708-235-0x0000016C16620000-0x0000016C16640000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/1708-238-0x0000016C163E0000-0x0000016C16400000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2012-211-0x00000290D8B30000-0x00000290D8B50000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2012-214-0x00000290D8AF0000-0x00000290D8B10000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2012-217-0x00000290D9100000-0x00000290D9120000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2624-146-0x000002AF54220000-0x000002AF54240000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2624-142-0x000002AF53E40000-0x000002AF53E60000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2624-144-0x000002AF53E00000-0x000002AF53E20000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2628-319-0x000001D97B160000-0x000001D97B180000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2628-317-0x000001D97ACD0000-0x000001D97ACF0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/2628-315-0x000001D97AD40000-0x000001D97AD60000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3024-94-0x000001FA96AB0000-0x000001FA96AD0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3024-100-0x000001FA97080000-0x000001FA970A0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3024-97-0x000001FA96A70000-0x000001FA96A90000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3396-45-0x0000024C71F70000-0x0000024C71F90000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3396-47-0x0000024C71F30000-0x0000024C71F50000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3396-49-0x0000024C723D0000-0x0000024C723F0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3516-251-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/3776-278-0x0000000004300000-0x0000000004301000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/3800-165-0x000001DC4F760000-0x000001DC4F780000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3800-170-0x000001DC4FB20000-0x000001DC4FB40000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3800-168-0x000001DC4F720000-0x000001DC4F740000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3964-62-0x0000000003680000-0x0000000003681000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/3996-194-0x00000293D2460000-0x00000293D2480000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3996-192-0x00000293D1DD0000-0x00000293D1DF0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/3996-189-0x00000293D1E10000-0x00000293D1E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4040-285-0x0000018743960000-0x0000018743980000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4040-287-0x0000018743920000-0x0000018743940000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4040-290-0x0000018743D20000-0x0000018743D40000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4224-37-0x0000000004750000-0x0000000004751000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4228-118-0x00000163A15E0000-0x00000163A1600000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4228-122-0x00000163A1A50000-0x00000163A1A70000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4228-120-0x00000163A1590000-0x00000163A15B0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4344-20-0x0000015BFCB50000-0x0000015BFCB70000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4344-14-0x0000015BFC740000-0x0000015BFC760000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4344-16-0x0000015BFC700000-0x0000015BFC720000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/4424-157-0x0000000004F70000-0x0000000004F71000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4464-227-0x00000000040E0000-0x00000000040E1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4560-134-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4588-181-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4672-204-0x0000000004030000-0x0000000004031000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4816-110-0x0000000002970000-0x0000000002971000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/4836-275-0x0000000002C20000-0x0000000002C21000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                  • memory/5072-70-0x000001F6CC7B0000-0x000001F6CC7D0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/5072-75-0x000001F6CCB80000-0x000001F6CCBA0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                  • memory/5072-72-0x000001F6CC770000-0x000001F6CC790000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB