Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2023, 08:02

General

  • Target

    922ba457846a2e261d0c9abd0547a3691f91ffbd7cf5ebc564f27a080a901f9f.exe

  • Size

    3.5MB

  • MD5

    b5e9ccedeb4bde5561c1f10a92096f67

  • SHA1

    8bf48bf1b707970d4ad2bf1913897ca92bbb7d10

  • SHA256

    922ba457846a2e261d0c9abd0547a3691f91ffbd7cf5ebc564f27a080a901f9f

  • SHA512

    e10d1c3fca0a1332c4a01981a300bb25f6e5324c21383d9f054b7ba5a3bb84441143715d047b468e6bea84eab38d557af13ccc8f58fc88daadfd42da4292e332

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlz4cWLJOIr390r07fRTHpIKm/c3d:c+8X9G3vP3AM1qE0VTH8ud

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\922ba457846a2e261d0c9abd0547a3691f91ffbd7cf5ebc564f27a080a901f9f.exe
    "C:\Users\Admin\AppData\Local\Temp\922ba457846a2e261d0c9abd0547a3691f91ffbd7cf5ebc564f27a080a901f9f.exe"
    1⤵
      PID:1956
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4252
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3948
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5096
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2452
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1632
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3832
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2136
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4436
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1176
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:872
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:1520
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3864
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1132
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2756
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4232
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4752
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:984
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3160
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3512
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:720
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3968
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:2716
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3372
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3188
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:1880
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:1936
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4260
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:5016
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3088
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4032
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1744
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:2096
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:5112
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:452
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2028
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:4456
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3888
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:4348
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:4452
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:2304
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:5004
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:1816
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:3628
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:2424
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:4880
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:1000
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2140
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3372
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:1936
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:4788
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:956
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:2272
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:920
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4164
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:4780

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                          Filesize

                                                                                                          471B

                                                                                                          MD5

                                                                                                          c3979bc0dda321fa97c72478e952f30a

                                                                                                          SHA1

                                                                                                          b59631a8ec458a5a6aa49d29355fca12e0ac0cfa

                                                                                                          SHA256

                                                                                                          7442271a27d6567f907facf61f78f0d392fc7ca99e105c68e895a307d7cb1afc

                                                                                                          SHA512

                                                                                                          1e76b970ac659ea59397929b57aca6978b348fe092a9ef2f9c264c27b3592b65957eb686c81c931b67d4c6bd513d7a639ff131fe3776bbc6ff102a6aae1a832d

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                          Filesize

                                                                                                          412B

                                                                                                          MD5

                                                                                                          be7b5ef56de1f262566d58585e114860

                                                                                                          SHA1

                                                                                                          da1a14c4893ef7a373593211ed4ac3101a178243

                                                                                                          SHA256

                                                                                                          db8d7c8225d9ce5640d184f926f1d8d383a657168abd55c0b470ba5da2a292b6

                                                                                                          SHA512

                                                                                                          e838c1d656a83b87319750230c68db3a0bab4c8b76d3d819aedb2cf65af822e0fbcd98710081978bca2f64ff17b561abad86c9d822dba83c86556e7c1c6cdba9

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          be4b2636d7729396aa0ff5648df595bf

                                                                                                          SHA1

                                                                                                          d9a583c2bff66ac84008cb7bb3bb826a5401f0dc

                                                                                                          SHA256

                                                                                                          9124da830675a7be89bbf8907dba1550c0d71f677458a4101f0f6a531f9f5c7e

                                                                                                          SHA512

                                                                                                          17b45dfb006c4d27aca091c9d7aab50cb581126f6a4f71cab72a03db44cbf8ffbb6b92a403f44c96e74494aa1c0beb6a661a6bd4968d8bb623c89294780b796c

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133451137529415797.txt

                                                                                                          Filesize

                                                                                                          74KB

                                                                                                          MD5

                                                                                                          0770cd8fe6784708d08860d93a5cb762

                                                                                                          SHA1

                                                                                                          ec3a74a70a55ac4e73f6ccaf01a7f4b86ca45cf8

                                                                                                          SHA256

                                                                                                          77c4ad43697c8de81a391a842311a1331fb37da159dcfe94eaa23e193479b1c2

                                                                                                          SHA512

                                                                                                          40c0c9f1e3a29320f68248439afe28ab00eef45b3dfbb9a3cc743a2f83374e6c2e8f36c57131a2c1b840c9f99b6c58b29f40ed453b03cd16607745fedae8e511

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                          SHA1

                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                          SHA256

                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                          SHA512

                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                        • memory/452-206-0x000001C1FE770000-0x000001C1FE790000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/452-204-0x000001C1FE360000-0x000001C1FE380000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/452-202-0x000001C1FE3A0000-0x000001C1FE3C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/720-112-0x000002A8983E0000-0x000002A898400000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/720-114-0x000002A8983A0000-0x000002A8983C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/720-116-0x000002A8987B0000-0x000002A8987D0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/920-349-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/984-92-0x0000020CB84D0000-0x0000020CB84F0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/984-94-0x0000020CB8AE0000-0x0000020CB8B00000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/984-89-0x0000020CB8510000-0x0000020CB8530000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1000-288-0x000001EDDBE00000-0x000001EDDBE20000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1000-291-0x000001EDDBBB0000-0x000001EDDBBD0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1000-294-0x000001EDDC1C0000-0x000001EDDC1E0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1176-38-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/1520-53-0x0000025FE32D0000-0x0000025FE32F0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1520-50-0x0000025FE2BC0000-0x0000025FE2BE0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1520-46-0x0000025FE2F00000-0x0000025FE2F20000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1744-179-0x00000241F0020000-0x00000241F0040000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1744-181-0x00000241EFDD0000-0x00000241EFDF0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1744-185-0x00000241F03E0000-0x00000241F0400000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1936-317-0x000002A461390000-0x000002A4613B0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1936-159-0x000001691A970000-0x000001691A990000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1936-157-0x000001691A560000-0x000001691A580000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1936-155-0x000001691A5A0000-0x000001691A5C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1936-312-0x000002A460DC0000-0x000002A460DE0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1936-314-0x000002A460D80000-0x000002A460DA0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2028-218-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2096-195-0x00000000044F0000-0x00000000044F1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2140-304-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2272-335-0x000001FCFC9B0000-0x000001FCFC9D0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2272-338-0x000001FCFC970000-0x000001FCFC990000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2272-342-0x000001FCFCD80000-0x000001FCFCDA0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2304-248-0x0000029A0C620000-0x0000029A0C640000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2304-250-0x0000029A0C3D0000-0x0000029A0C3F0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2304-253-0x0000029A0C9E0000-0x0000029A0CA00000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2424-281-0x0000000004070000-0x0000000004071000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2756-68-0x0000014E9ACB0000-0x0000014E9ACD0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2756-70-0x0000014E9AC70000-0x0000014E9AC90000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2756-74-0x0000014E9B280000-0x0000014E9B2A0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3088-172-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/3160-104-0x0000000002D10000-0x0000000002D11000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/3188-147-0x0000000004040000-0x0000000004041000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/3372-132-0x00000155058E0000-0x0000015505900000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3372-135-0x00000155058A0000-0x00000155058C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3372-138-0x0000015505EC0000-0x0000015505EE0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3628-271-0x000001F2EA020000-0x000001F2EA040000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3628-268-0x000001F2EA060000-0x000001F2EA080000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3628-273-0x000001F2EA4D0000-0x000001F2EA4F0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3832-15-0x00000000043D0000-0x00000000043D1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/3864-61-0x0000000004890000-0x0000000004891000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/3888-225-0x000001A7923D0000-0x000001A7923F0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3888-231-0x000001A7927A0000-0x000001A7927C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3888-228-0x000001A792390000-0x000001A7923B0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3968-124-0x0000000004410000-0x0000000004411000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4164-357-0x0000027D1C440000-0x0000027D1C460000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4164-360-0x0000027D1C850000-0x0000027D1C870000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4164-355-0x0000027D1C480000-0x0000027D1C4A0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4232-82-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4348-241-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4436-21-0x000001FFCB5C0000-0x000001FFCB5E0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4436-26-0x000001FFCBBA0000-0x000001FFCBBC0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4436-24-0x000001FFCB580000-0x000001FFCB5A0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4788-327-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/5004-260-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB