Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2023, 10:01

General

  • Target

    41f62c7cfdaf4780dd2aca7d99ed4d5f9db76aabcc04e492431a1abc0f2bf683.exe

  • Size

    3.5MB

  • MD5

    fd9e829c0bd15b7f7e4d5fdc623d7eee

  • SHA1

    8fd96d49665f24a993ca64079883ebeb48afcc58

  • SHA256

    41f62c7cfdaf4780dd2aca7d99ed4d5f9db76aabcc04e492431a1abc0f2bf683

  • SHA512

    ee68aaef80ad7a42c52e10c3d1ecc5fe0072387969f415a936f776ac3f8d3b922cba3ec8b4f4c33bbdd50be6141c14cb260c1f043322d11275386a565fd58af4

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlmDvM2mOGPG+RAyRvWwk5Zs3:c+8X9G3vP3AMWvM2eG+rvWwsq3

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\41f62c7cfdaf4780dd2aca7d99ed4d5f9db76aabcc04e492431a1abc0f2bf683.exe
    "C:\Users\Admin\AppData\Local\Temp\41f62c7cfdaf4780dd2aca7d99ed4d5f9db76aabcc04e492431a1abc0f2bf683.exe"
    1⤵
      PID:4956
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1804
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1512
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:2080
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4592
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3480
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1912
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2748
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:368
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3152
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1948
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2648
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4036
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:1272
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3528
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:748
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3928
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:1404
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:1912
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4080
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3556
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        • Enumerates connected drives
                                        • Checks SCSI registry key(s)
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:2080
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1404
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:2656
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2296
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4932
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3836
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4160
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4864
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1932
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3876
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1136
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4000
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4840
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4072
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:2944
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3128
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3928
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:380
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4880
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4020
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:1912
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1296
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3056
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2848
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:5076
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:436
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3528
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4380
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3492
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:4912
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:4816
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3568
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:4848
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:4196
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:1184
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:2652
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:3656
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:3916
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:1272
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:3688

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                      Filesize

                                                                                                                      471B

                                                                                                                      MD5

                                                                                                                      4457348ffb6677a1e3a91cb2f4557544

                                                                                                                      SHA1

                                                                                                                      1df8c2fbfce71f7d83e7725f7eaba9e2c8090bd0

                                                                                                                      SHA256

                                                                                                                      d71daa46393a3ce3c8f83fe692ef9cbcb72300a7d3ed14991e6be2492a6a1510

                                                                                                                      SHA512

                                                                                                                      51648f252f29b9860aa1e7b2f8dc2a3e0c5bacf5e0d12655c6f03d7661cba5b8ffc8633dba2b8ea6936a62ac10cdee7d3729b9133ae1f403703832674cc4dbe2

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                      Filesize

                                                                                                                      412B

                                                                                                                      MD5

                                                                                                                      a45f2bc094af57dd0ac415e44448e695

                                                                                                                      SHA1

                                                                                                                      b967ba0a1fd420fd2ede5604e56fc94dbd62c382

                                                                                                                      SHA256

                                                                                                                      e3ff0c1f7efb4d20238de7f44462012a68bb7f526b71cc37ff4aff622b47a192

                                                                                                                      SHA512

                                                                                                                      5801d00acd7d994ee6b8f23fe129f8c5c0278c8da9e021ceebc41c8dd0639a8b0e4774253979f8bca2f823b21ec7408d085bd2062acdd6e942a6357c879ba1a8

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      c4acb3751e866ddb45f77b8de36c3b43

                                                                                                                      SHA1

                                                                                                                      dac28fc044c173a433a0af7aa8a583b083aeadb8

                                                                                                                      SHA256

                                                                                                                      b8e662009b19136e46578fd7ee40186a595c8120902b61095f6cc754284aa786

                                                                                                                      SHA512

                                                                                                                      8f5a592eee3ce8adff58d86e20d15b5c19531a7df555e844e2f8061faab0dfb534ba4519a323940284f081cb79aa0773d89a120c250e7358eaaf0140e9f39827

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      da2f6534a0b18d822eafa495c037a7f4

                                                                                                                      SHA1

                                                                                                                      9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                      SHA256

                                                                                                                      e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                      SHA512

                                                                                                                      d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                    • memory/368-29-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/380-211-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/436-255-0x0000000004440000-0x0000000004441000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/748-60-0x000001F841160000-0x000001F841180000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/748-65-0x000001F841520000-0x000001F841540000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/748-62-0x000001F841120000-0x000001F841140000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1184-322-0x0000000004160000-0x0000000004161000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1272-52-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1912-90-0x00000232391C0000-0x00000232391E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1912-88-0x0000023238D20000-0x0000023238D40000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1912-85-0x0000023238D60000-0x0000023238D80000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1932-157-0x000002C720A50000-0x000002C720A70000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1932-153-0x000002C720680000-0x000002C7206A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1932-155-0x000002C720640000-0x000002C720660000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1948-36-0x0000020E7D160000-0x0000020E7D180000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1948-41-0x0000020E7D530000-0x0000020E7D550000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1948-39-0x0000020E7D120000-0x0000020E7D140000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2080-8-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2080-102-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2296-122-0x0000000003420000-0x0000000003421000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2656-110-0x0000022064F70000-0x0000022064F90000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2656-114-0x0000022064F30000-0x0000022064F50000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2656-117-0x0000022065340000-0x0000022065360000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2944-193-0x000001C8EC4B0000-0x000001C8EC4D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2944-198-0x000001C8ECAA0000-0x000001C8ECAC0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2944-196-0x000001C8EC470000-0x000001C8EC490000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3056-235-0x0000000003E20000-0x0000000003E21000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3480-18-0x00000165806B0000-0x00000165806D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3480-15-0x00000165806F0000-0x0000016580710000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3480-20-0x0000016580CC0000-0x0000016580CE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3492-277-0x0000000004480000-0x0000000004481000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3568-295-0x0000000004480000-0x0000000004481000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3656-335-0x000001977CB40000-0x000001977CB60000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3656-330-0x000001977C4B0000-0x000001977C4D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3656-333-0x000001977C470000-0x000001977C490000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3836-130-0x000001DFE6E60000-0x000001DFE6E80000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3836-134-0x000001DFE72D0000-0x000001DFE72F0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3836-132-0x000001DFE6E20000-0x000001DFE6E40000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3876-165-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3928-77-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4000-180-0x00000178B78C0000-0x00000178B78E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4000-173-0x00000178B72E0000-0x00000178B7300000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4000-177-0x00000178B72A0000-0x00000178B72C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4020-218-0x00000239832F0000-0x0000023983310000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4020-222-0x0000023983980000-0x00000239839A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4020-220-0x00000239832B0000-0x00000239832D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4160-145-0x00000000042B0000-0x00000000042B1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4196-306-0x0000022825B00000-0x0000022825B20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4196-308-0x0000022825F00000-0x0000022825F20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4196-302-0x0000022825B40000-0x0000022825B60000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4380-262-0x000001C1C1C70000-0x000001C1C1C90000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4380-267-0x000001C1C20F0000-0x000001C1C2110000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4380-265-0x000001C1C1C30000-0x000001C1C1C50000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4816-287-0x000001E1695A0000-0x000001E1695C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4816-285-0x000001E168F90000-0x000001E168FB0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4816-282-0x000001E168FD0000-0x000001E168FF0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4840-185-0x00000000042F0000-0x00000000042F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/5076-248-0x0000029207700000-0x0000029207720000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5076-242-0x0000029207120000-0x0000029207140000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5076-244-0x00000292070E0000-0x0000029207100000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB