Analysis

  • max time kernel
    18s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 19:12

General

  • Target

    626f41d30f8bfb66aaa4052fdc291ca22e2bb153f65021735366c333a7d63da7.exe

  • Size

    3.2MB

  • MD5

    69fdd27df7fe33fbc1fa5dec1b415c3a

  • SHA1

    9058f2121655089830be7cb5df60cdc2d482bda9

  • SHA256

    626f41d30f8bfb66aaa4052fdc291ca22e2bb153f65021735366c333a7d63da7

  • SHA512

    d0ad815be113b9fdfa722ce4163802f5c18505e3aada9aa77caf38f6d8295a3c812902d2d345ff1d8f29a4237fe886ca32a2d487613b1874eca46a2e6bd5473f

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlkWVHNVhTrX3fBz38:c+8X9G3vP3AMuSHNVZDBzM

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\626f41d30f8bfb66aaa4052fdc291ca22e2bb153f65021735366c333a7d63da7.exe
    "C:\Users\Admin\AppData\Local\Temp\626f41d30f8bfb66aaa4052fdc291ca22e2bb153f65021735366c333a7d63da7.exe"
    1⤵
      PID:3768
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4656
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:556
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3128
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3512
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4672
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3668
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2032
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1976
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2988
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4132
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4428
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3732
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3928
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:556
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1632
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4572
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4336
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:408
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1372
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1652
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4772
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1664
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4280
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4824
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4656
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4292
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2812
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4748
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3084
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:5072
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:2620
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:852
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2164
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3420
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4396
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:408
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:4660
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4420
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:3876
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4676
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4584
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1152
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:2844
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:1380
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:1752
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2096
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4984
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:3516
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:468
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:224
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:3876
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:808
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:1460
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:3628
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:1276
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2812
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:2132

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                471B

                                                                                                                MD5

                                                                                                                ffdc1fb931b665627497ada6fb20602a

                                                                                                                SHA1

                                                                                                                bdfca82b7c90127cc7e6003475e23306b14faece

                                                                                                                SHA256

                                                                                                                9850294b48b31b4686f756e363de4183ef1e4456891ba03e06064648d9719aa2

                                                                                                                SHA512

                                                                                                                9bd84711fd17f24b018654ff02a0821e4df14c183501e71ccf4b9dc442f346a429df283b6740314b1d031c9ee7453f8090ad47da0db7397d60e347a0a9f953e3

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                412B

                                                                                                                MD5

                                                                                                                55e70441c6c21023f6eab16d35b873d0

                                                                                                                SHA1

                                                                                                                f81a34242e8e190d6fb966bc4929057a5a4f4882

                                                                                                                SHA256

                                                                                                                f8b407f065bca852d31c155f0b45ff2ba2e9bf144f5994d2d7c0a1172cf9a766

                                                                                                                SHA512

                                                                                                                9a685c1ccc13f99fabf155378aba1ed3af5220083516b4fda8dd9611ed1850bfe7b4400d19477587d5210c202860e1462e6ee348937bcee7f8b3cb0631000f3e

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                455a42f25f85be41cfe5a94c31524b96

                                                                                                                SHA1

                                                                                                                c982aab395959df6765e9db22cbdc22972683c7f

                                                                                                                SHA256

                                                                                                                9ee027eedd763feffda8d5513cb93580dcc6ea248c9e477360ee52240df3207b

                                                                                                                SHA512

                                                                                                                a32a26f478e722329846133aa27008d5c092e1c4c09700a02a995ed8ff81e7d16ab92d87cba7f10b93ea384818218d70e4ad3302754778142a58f44f2c820852

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133433396084887529.txt

                                                                                                                Filesize

                                                                                                                74KB

                                                                                                                MD5

                                                                                                                0770cd8fe6784708d08860d93a5cb762

                                                                                                                SHA1

                                                                                                                ec3a74a70a55ac4e73f6ccaf01a7f4b86ca45cf8

                                                                                                                SHA256

                                                                                                                77c4ad43697c8de81a391a842311a1331fb37da159dcfe94eaa23e193479b1c2

                                                                                                                SHA512

                                                                                                                40c0c9f1e3a29320f68248439afe28ab00eef45b3dfbb9a3cc743a2f83374e6c2e8f36c57131a2c1b840c9f99b6c58b29f40ed453b03cd16607745fedae8e511

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Z7LOIA6T\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                25b98f558f0ca5ad449151322b6034e1

                                                                                                                SHA1

                                                                                                                ce562dcce60d8dab8767a0cfafc3b0ef5458c546

                                                                                                                SHA256

                                                                                                                bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d

                                                                                                                SHA512

                                                                                                                2c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275

                                                                                                              • memory/224-309-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/408-95-0x0000022A24B40000-0x0000022A24B60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/408-92-0x0000022A24730000-0x0000022A24750000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/408-90-0x0000022A24770000-0x0000022A24790000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/468-299-0x00000177AADF0000-0x00000177AAE10000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/468-297-0x00000177AA7E0000-0x00000177AA800000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/468-294-0x00000177AAA20000-0x00000177AAA40000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/808-322-0x0000016E91F20000-0x0000016E91F40000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/808-317-0x0000016E91930000-0x0000016E91950000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/808-320-0x0000016E918D0000-0x0000016E918F0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/852-174-0x0000000004730000-0x0000000004731000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1380-266-0x00000000046C0000-0x00000000046C1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1460-330-0x00000000038E0000-0x00000000038E1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/1976-37-0x0000000004600000-0x0000000004601000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/2096-274-0x000001F71A870000-0x000001F71A890000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2096-278-0x000001F71AC40000-0x000001F71AC60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2096-276-0x000001F71A830000-0x000001F71A850000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2620-161-0x00000222B4170000-0x00000222B4190000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2620-164-0x00000222B4620000-0x00000222B4640000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2620-159-0x00000222B41B0000-0x00000222B41D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2844-253-0x00000258B53A0000-0x00000258B53C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2844-258-0x00000258B5AB0000-0x00000258B5AD0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2844-251-0x00000258B53E0000-0x00000258B5400000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3084-151-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3128-8-0x00000000041A0000-0x00000000041A1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3420-187-0x00000243B9680000-0x00000243B96A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3420-184-0x00000243B9270000-0x00000243B9290000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3420-182-0x00000243B92B0000-0x00000243B92D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3628-337-0x0000013518B40000-0x0000013518B60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3628-340-0x0000013518B00000-0x0000013518B20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3628-344-0x0000013518F10000-0x0000013518F30000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3928-66-0x0000024C138F0000-0x0000024C13910000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3928-69-0x0000024C138B0000-0x0000024C138D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3928-73-0x0000024C13EC0000-0x0000024C13EE0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4132-51-0x0000017F42A50000-0x0000017F42A70000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4132-49-0x0000017F42640000-0x0000017F42660000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4132-45-0x0000017F42680000-0x0000017F426A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4280-121-0x0000016FD36E0000-0x0000016FD3700000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4280-114-0x0000016FD3100000-0x0000016FD3120000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4280-116-0x0000016FD30C0000-0x0000016FD30E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4292-139-0x000002440D9E0000-0x000002440DA00000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4292-137-0x000002440DC20000-0x000002440DC40000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4292-142-0x000002440DFF0000-0x000002440E010000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4396-197-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4420-221-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4428-58-0x0000000004690000-0x0000000004691000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4572-83-0x0000000003EE0000-0x0000000003EE1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4584-243-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4660-211-0x000001EE89970000-0x000001EE89990000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4660-207-0x000001EE89560000-0x000001EE89580000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4660-205-0x000001EE895A0000-0x000001EE895C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4672-19-0x00000248CDA60000-0x00000248CDA80000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4672-17-0x00000248CD450000-0x00000248CD470000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4672-14-0x00000248CD490000-0x00000248CD4B0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4676-228-0x000001695D3A0000-0x000001695D3C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4676-234-0x000001695D770000-0x000001695D790000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4676-230-0x000001695D360000-0x000001695D380000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4772-106-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4824-129-0x0000000004070000-0x0000000004071000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4984-286-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB