Overview

overview

8

Static

static

3

a389efc581...2d.exe

windows7-x64

8

a389efc581...2d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    28s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 08:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a389efc581cc0c482b9816dc8c48951b2fbfd0b5c5bb705665ea5c29da1d262d.exe

  • Size

    3.0MB

  • MD5

    94778c410070f6f0bad7a5635a7fd619

  • SHA1

    5a78db2f17c0c4a868b6ed63a9d803cf88e54b12

  • SHA256

    a389efc581cc0c482b9816dc8c48951b2fbfd0b5c5bb705665ea5c29da1d262d

  • SHA512

    369761332ba6082e8351225760787d343789a2cb1f3e69ae053e83948693dbf05c491db67624e530ff7bc016c3ae42ede69ac4d3b0c19b03fa1cd1af1e41d0af

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlpOK8b9qp6:Q+8X9G3vP3AMXOru6

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a389efc581cc0c482b9816dc8c48951b2fbfd0b5c5bb705665ea5c29da1d262d.exe
    "C:\Users\Admin\AppData\Local\Temp\a389efc581cc0c482b9816dc8c48951b2fbfd0b5c5bb705665ea5c29da1d262d.exe"
    1⤵
      PID:2952
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:968
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:840
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:464
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3580
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4896
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4320
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5104
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:928
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3488
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3908
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3392
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3248
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5100
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4040
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3940
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3580
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4156
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4968
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4132
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3376
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3504
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3428
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3264
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4052
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:2724
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4908
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3240
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3112
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:2836
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4464
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3744
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3472
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3412
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:2516
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4044
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2836
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:2892
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4016
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3928
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3980
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4224
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3896
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4168
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3448
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:808
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4120
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4996
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:3544
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:2288
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:4632
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4404
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:4644
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3208
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1080
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:4864
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2068
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:2764
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:2836
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3784
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:2504
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4904
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:1164
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:1604
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:3116
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:2320
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:844
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:3784
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4660
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:968
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:4216
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:1940
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:4196
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:5012
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4312
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:3308
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:1724
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:2772
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:2800
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1040
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:4396
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:1152
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4376
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4284
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4084
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3256
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1456
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4792

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                  Filesize

                                                                                                                                                                  471B

                                                                                                                                                                  MD5

                                                                                                                                                                  1229feb9159ffcbb03f63dc35db39773

                                                                                                                                                                  SHA1

                                                                                                                                                                  52de1325285bbd20fed303cbf56b113f3531497f

                                                                                                                                                                  SHA256

                                                                                                                                                                  1a1830716ed3c9efa87191e819f3e3f6775740a608a5e5a62c9833119c934db1

                                                                                                                                                                  SHA512

                                                                                                                                                                  a895410dd807a222dc1a0649e4d1ec6fbc010ba8cc0ec6a6e16f32cfc0e19b564b1430f2da6f5e605bdbb697394aa013c6469c2143da8f4308a0d60ac7daa231

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                  Filesize

                                                                                                                                                                  412B

                                                                                                                                                                  MD5

                                                                                                                                                                  71b1cf41248c6670cbb152b4e5cbb257

                                                                                                                                                                  SHA1

                                                                                                                                                                  ebd53e6636ef6241206701348cc4b356db872e1e

                                                                                                                                                                  SHA256

                                                                                                                                                                  02a30b407208864c9611e3ac6f6974b51547937d5a521d9d46ec0194a539e3a8

                                                                                                                                                                  SHA512

                                                                                                                                                                  77ff1fa82fa57e405e69a96c21d7dbc6076fea9dcac2e45c0c328a71a01358f2ae70bf18a147f5dead72c7c5276dd47754e4b0ad59eb52834285d8ad4f697c98

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                                  Filesize

                                                                                                                                                                  2KB

                                                                                                                                                                  MD5

                                                                                                                                                                  c4e76ff099c2123928f7741edecb63a4

                                                                                                                                                                  SHA1

                                                                                                                                                                  8a6c61d20edee0ea9de528a35259ccd8166345e4

                                                                                                                                                                  SHA256

                                                                                                                                                                  c1b2beae2aaafb4418e79c375ebcbe847fa0b7e52ad50ce43e5404e5a8da1c4a

                                                                                                                                                                  SHA512

                                                                                                                                                                  8f02f6820f40333fcb8a50cc2c97c6475d56e6dadbe82538662d11b0bf7ddce0765ed94c2fb5d4929289403ade94ca6b5602b0f97b768c454a7b29c10fe1288c

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TERA0QIF\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  8d6e57645a3894c78fedfd96931fb799

                                                                                                                                                                  SHA1

                                                                                                                                                                  8fa46e487e762948f191626bc0e39bdf52b4a367

                                                                                                                                                                  SHA256

                                                                                                                                                                  9dceae2923a4265b821c1e66e634f7ad1a2ad12e0f1e41effcc8662aa1980f24

                                                                                                                                                                  SHA512

                                                                                                                                                                  14947e39d023e6e94d6ddfbf2ee971f37ac4ff96a0faa6b3d069b9cc07f6452e99c54f4edfdccbf0c4013a2c9827db200d2cae3ec6e509044c507b6b653fdd59

                                                                                                                                                                  Download Submit

                                                                                                                                                                • memory/464-7-0x00000000032F0000-0x00000000032F1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/928-44-0x000001989BE00000-0x000001989BE20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/928-42-0x000001989B9F0000-0x000001989BA10000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/928-39-0x000001989BA30000-0x000001989BA50000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1164-355-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2068-308-0x00000000043A0000-0x00000000043A1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2724-147-0x0000000003500000-0x0000000003501000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2836-318-0x000001E585290000-0x000001E5852B0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2836-320-0x000001E5858A0000-0x000001E5858C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2836-316-0x000001E5852D0000-0x000001E5852F0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2892-205-0x0000016F93F00000-0x0000016F93F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2892-207-0x0000016F94310000-0x0000016F94330000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2892-203-0x0000016F93F40000-0x0000016F93F60000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3116-367-0x000001D074370000-0x000001D074390000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3116-365-0x000001D073F60000-0x000001D073F80000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3116-363-0x000001D073FA0000-0x000001D073FC0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3208-296-0x000001BE14580000-0x000001BE145A0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3208-292-0x000001BE141B0000-0x000001BE141D0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3208-294-0x000001BE14170000-0x000001BE14190000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3240-159-0x0000018FF8150000-0x0000018FF8170000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3240-157-0x0000018FF7D40000-0x0000018FF7D60000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3240-155-0x0000018FF7D80000-0x0000018FF7DA0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3248-79-0x00000000046E0000-0x00000000046E1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3376-123-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3392-68-0x000001BDB9540000-0x000001BDB9560000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3392-64-0x000001BDB9130000-0x000001BDB9150000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3392-62-0x000001BDB9170000-0x000001BDB9190000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3428-133-0x000001C77CD90000-0x000001C77CDB0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3428-131-0x000001C77CDD0000-0x000001C77CDF0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3428-135-0x000001C77D1A0000-0x000001C77D1C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3472-184-0x000001C6058C0000-0x000001C6058E0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3472-179-0x000001C6052E0000-0x000001C605300000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3472-181-0x000001C6052A0000-0x000001C6052C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3488-55-0x00000000021A0000-0x00000000021A1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3544-271-0x00000236FF300000-0x00000236FF320000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3544-273-0x00000236FF2C0000-0x00000236FF2E0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3544-276-0x00000236FF8E0000-0x00000236FF900000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3784-333-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3980-224-0x000001BF23660000-0x000001BF23680000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3980-228-0x000001BF23A30000-0x000001BF23A50000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3980-226-0x000001BF23620000-0x000001BF23640000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4016-216-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4040-92-0x0000016C7B420000-0x0000016C7B440000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4040-88-0x0000016C7B010000-0x0000016C7B030000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4040-86-0x0000016C7B050000-0x0000016C7B070000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4044-195-0x0000000004560000-0x0000000004561000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4120-263-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4132-117-0x000001C840670000-0x000001C840690000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4132-113-0x000001C840260000-0x000001C840280000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4132-110-0x000001C8402A0000-0x000001C8402C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4156-103-0x0000000003E10000-0x0000000003E11000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4168-249-0x000001DCBD880000-0x000001DCBD8A0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4168-247-0x000001DCBD8C0000-0x000001DCBD8E0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4168-252-0x000001DCBDEA0000-0x000001DCBDEC0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4224-239-0x0000000004020000-0x0000000004021000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4320-31-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4404-284-0x0000000004450000-0x0000000004451000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4464-171-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4896-20-0x0000021AFC330000-0x0000021AFC350000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4896-17-0x0000021AFBF20000-0x0000021AFBF40000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4896-14-0x0000021AFBF60000-0x0000021AFBF80000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4904-346-0x000001D53B2C0000-0x000001D53B2E0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4904-343-0x000001D53ACA0000-0x000001D53ACC0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4904-340-0x000001D53ACE0000-0x000001D53AD00000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download