Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2023, 08:05 UTC

General

  • Target

    70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe

  • Size

    3.1MB

  • MD5

    ea7575dd536ac37860713888cff22ac6

  • SHA1

    6f4903342863d196dfaa9c3fcfdaf266727023a3

  • SHA256

    70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301

  • SHA512

    075a40209851e52881cb73a13b996d8a7c422ab43d1212dd8df35e0bac94e63c6387313143306d96306d88873eb0e95543d01c5c54b8874b1888067c0ac94b60

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlk0h8vsIZycMrxR48x/t7Pdh+M86V:c+8X9G3vP3AMt3cg/Ff7V

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe
    "C:\Users\Admin\AppData\Local\Temp\70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe"
    1⤵
      PID:1092
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3352
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:496
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4860
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:776
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3760
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4152
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4572
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:4888
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3632
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4380
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:1372
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4572
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1856
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4308
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4636
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3452
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3568
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:688
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2224
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1280
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4752
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2012
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3012
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3396
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2760
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:2148
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4356
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4448
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:2808
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2796
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4624
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3756
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1940
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4264
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3664
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4628
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3620
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3964
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2160
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4380
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:2796
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:3276
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:2604
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2908
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:2004
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:4984
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3908
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2360
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:948
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4304
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:2796
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3684
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4028
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                    • Modifies Installed Components in the registry
                                                                                                    • Enumerates connected drives
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    PID:4572
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:1372
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:1304
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:2192
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:4216
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:4884
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:4868
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4980
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3692
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4036
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:1328
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:2240
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:4132
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:2440
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:3776
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4984
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:948
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:1584
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Modifies registry class
                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                      PID:4572
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:708
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:424
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:3608
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:1960
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:3080

                                                                                                                                              Network

                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                8.8.8.8.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                8.8.8.8.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                                8.8.8.8.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                dnsgoogle
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                20.160.190.20.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                20.160.190.20.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                122.175.53.84.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                122.175.53.84.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                                122.175.53.84.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                a84-53-175-122deploystaticakamaitechnologiescom
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                9.228.82.20.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                9.228.82.20.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                39.142.81.104.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                39.142.81.104.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                                39.142.81.104.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                a104-81-142-39deploystaticakamaitechnologiescom
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                2.136.104.51.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                2.136.104.51.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                43.58.199.20.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                43.58.199.20.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                103.169.127.40.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                103.169.127.40.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                15.164.165.52.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                15.164.165.52.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                254.1.248.8.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                254.1.248.8.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                31.243.111.52.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                31.243.111.52.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                26.35.223.20.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                26.35.223.20.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                tse1.mm.bing.net
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                tse1.mm.bing.net
                                                                                                                                                IN A
                                                                                                                                                Response
                                                                                                                                                tse1.mm.bing.net
                                                                                                                                                IN CNAME
                                                                                                                                                mm-mm.bing.net.trafficmanager.net
                                                                                                                                                mm-mm.bing.net.trafficmanager.net
                                                                                                                                                IN CNAME
                                                                                                                                                dual-a-0001.a-msedge.net
                                                                                                                                                dual-a-0001.a-msedge.net
                                                                                                                                                IN A
                                                                                                                                                204.79.197.200
                                                                                                                                                dual-a-0001.a-msedge.net
                                                                                                                                                IN A
                                                                                                                                                13.107.21.200
                                                                                                                                              • flag-us
                                                                                                                                                DNS
                                                                                                                                                211.143.182.52.in-addr.arpa
                                                                                                                                                Remote address:
                                                                                                                                                8.8.8.8:53
                                                                                                                                                Request
                                                                                                                                                211.143.182.52.in-addr.arpa
                                                                                                                                                IN PTR
                                                                                                                                                Response
                                                                                                                                              • 10.127.0.90:7799
                                                                                                                                                70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe
                                                                                                                                              • 10.127.0.90:6217
                                                                                                                                                70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe
                                                                                                                                              • 10.127.0.90:25871
                                                                                                                                                70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe
                                                                                                                                              • 204.79.197.200:443
                                                                                                                                                tse1.mm.bing.net
                                                                                                                                                tls
                                                                                                                                                1.2kB
                                                                                                                                                8.3kB
                                                                                                                                                16
                                                                                                                                                14
                                                                                                                                              • 204.79.197.200:443
                                                                                                                                                tse1.mm.bing.net
                                                                                                                                                tls
                                                                                                                                                1.2kB
                                                                                                                                                8.3kB
                                                                                                                                                16
                                                                                                                                                14
                                                                                                                                              • 204.79.197.200:443
                                                                                                                                                tse1.mm.bing.net
                                                                                                                                                tls
                                                                                                                                                68.0kB
                                                                                                                                                1.8MB
                                                                                                                                                1359
                                                                                                                                                1354
                                                                                                                                              • 10.127.0.90:7799
                                                                                                                                                70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe
                                                                                                                                              • 10.127.0.90:6217
                                                                                                                                                70f27da387e2045720492810548817cc34bb416c12353f57346238aa73c46301.exe
                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                8.8.8.8.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                66 B
                                                                                                                                                90 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                8.8.8.8.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                20.160.190.20.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                72 B
                                                                                                                                                158 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                20.160.190.20.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                122.175.53.84.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                72 B
                                                                                                                                                137 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                122.175.53.84.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                9.228.82.20.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                70 B
                                                                                                                                                156 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                9.228.82.20.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                39.142.81.104.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                72 B
                                                                                                                                                137 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                39.142.81.104.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                2.136.104.51.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                71 B
                                                                                                                                                157 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                2.136.104.51.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                43.58.199.20.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                71 B
                                                                                                                                                157 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                43.58.199.20.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                103.169.127.40.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                73 B
                                                                                                                                                147 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                103.169.127.40.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                15.164.165.52.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                72 B
                                                                                                                                                146 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                15.164.165.52.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                254.1.248.8.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                70 B
                                                                                                                                                124 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                254.1.248.8.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                31.243.111.52.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                72 B
                                                                                                                                                158 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                31.243.111.52.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                26.35.223.20.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                71 B
                                                                                                                                                157 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                26.35.223.20.in-addr.arpa

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                tse1.mm.bing.net
                                                                                                                                                dns
                                                                                                                                                62 B
                                                                                                                                                173 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                tse1.mm.bing.net

                                                                                                                                                DNS Response

                                                                                                                                                204.79.197.200
                                                                                                                                                13.107.21.200

                                                                                                                                              • 8.8.8.8:53
                                                                                                                                                211.143.182.52.in-addr.arpa
                                                                                                                                                dns
                                                                                                                                                73 B
                                                                                                                                                147 B
                                                                                                                                                1
                                                                                                                                                1

                                                                                                                                                DNS Request

                                                                                                                                                211.143.182.52.in-addr.arpa

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                                Filesize

                                                                                                                                                471B

                                                                                                                                                MD5

                                                                                                                                                c3979bc0dda321fa97c72478e952f30a

                                                                                                                                                SHA1

                                                                                                                                                b59631a8ec458a5a6aa49d29355fca12e0ac0cfa

                                                                                                                                                SHA256

                                                                                                                                                7442271a27d6567f907facf61f78f0d392fc7ca99e105c68e895a307d7cb1afc

                                                                                                                                                SHA512

                                                                                                                                                1e76b970ac659ea59397929b57aca6978b348fe092a9ef2f9c264c27b3592b65957eb686c81c931b67d4c6bd513d7a639ff131fe3776bbc6ff102a6aae1a832d

                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                                Filesize

                                                                                                                                                412B

                                                                                                                                                MD5

                                                                                                                                                daa685583ab408af3f278ff46e4276a0

                                                                                                                                                SHA1

                                                                                                                                                399e74703a84bc6690576bdaff0c109014af51fd

                                                                                                                                                SHA256

                                                                                                                                                c3d5ed491a5f955b1e1317330d42c0382b9f0662cad5ae2c0a350c94905e525c

                                                                                                                                                SHA512

                                                                                                                                                c3f86e3cbe3d706ddd41dc044e06337daff34d71b9987e07a56f7d445875026fec631399624e9e1179789a4c1997b231dc6ac5b8b633218c413bdb37430f49f1

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                7e0d40b5285cc307e626c7502830ede9

                                                                                                                                                SHA1

                                                                                                                                                420c3a1707fe0bb56265c2b8612797fce6ad227c

                                                                                                                                                SHA256

                                                                                                                                                e66767b7c57b754fae94f1b52229288a4518bcbc60f126e0f48b5a646dc6bbb8

                                                                                                                                                SHA512

                                                                                                                                                7d207647ec4b93a2389830f87cee5a34b8c26af2b5987e519b2b62a8d3089bd8c0de07894e40170bca097b868b5b534844c89c8b12fa2c4e7b56d1a027758f56

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133451139320502221.txt

                                                                                                                                                Filesize

                                                                                                                                                74KB

                                                                                                                                                MD5

                                                                                                                                                0770cd8fe6784708d08860d93a5cb762

                                                                                                                                                SHA1

                                                                                                                                                ec3a74a70a55ac4e73f6ccaf01a7f4b86ca45cf8

                                                                                                                                                SHA256

                                                                                                                                                77c4ad43697c8de81a391a842311a1331fb37da159dcfe94eaa23e193479b1c2

                                                                                                                                                SHA512

                                                                                                                                                40c0c9f1e3a29320f68248439afe28ab00eef45b3dfbb9a3cc743a2f83374e6c2e8f36c57131a2c1b840c9f99b6c58b29f40ed453b03cd16607745fedae8e511

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml

                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                SHA1

                                                                                                                                                9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                SHA256

                                                                                                                                                e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                SHA512

                                                                                                                                                d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                              • memory/776-12-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/1372-254-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/1584-328-0x0000000004020000-0x0000000004021000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/2004-207-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/2012-86-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/2192-266-0x00000188ECD10000-0x00000188ECD30000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2192-264-0x00000188EC860000-0x00000188EC880000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2192-262-0x00000188EC8A0000-0x00000188EC8C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2224-72-0x000002070A3B0000-0x000002070A3D0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2224-70-0x0000020709F00000-0x0000020709F20000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2224-68-0x0000020709F40000-0x0000020709F60000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2240-310-0x00000164032E0000-0x0000016403300000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2240-315-0x00000164038C0000-0x00000164038E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2240-313-0x00000164032A0000-0x00000164032C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2796-134-0x00000000011A0000-0x00000000011A1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/2808-124-0x00000227CC270000-0x00000227CC290000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2808-122-0x00000227CBBD0000-0x00000227CBBF0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/2808-119-0x00000227CBE20000-0x00000227CBE40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3080-366-0x000001DA8E440000-0x000001DA8E460000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3080-371-0x000001DA8E870000-0x000001DA8E890000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3080-369-0x000001DA8E400000-0x000001DA8E420000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3276-194-0x00000241E5520000-0x00000241E5540000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3276-196-0x00000241E5920000-0x00000241E5940000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3276-190-0x00000241E5560000-0x00000241E5580000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3396-99-0x0000026706870000-0x0000026706890000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3396-94-0x00000267064A0000-0x00000267064C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3396-97-0x0000026706460000-0x0000026706480000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3568-60-0x0000000004290000-0x0000000004291000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/3608-359-0x0000000004E90000-0x0000000004E91000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/3620-172-0x00000156C6150000-0x00000156C6170000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3620-169-0x00000156C5CB0000-0x00000156C5CD0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3620-166-0x00000156C5CF0000-0x00000156C5D10000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3664-158-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/3684-238-0x000002E572290000-0x000002E5722B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3684-242-0x000002E5728F0000-0x000002E572910000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3684-240-0x000002E572250000-0x000002E572270000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3756-144-0x00000277FFA90000-0x00000277FFAB0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3756-147-0x00000277FFEA0000-0x00000277FFEC0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3756-142-0x00000277FFAD0000-0x00000277FFAF0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3908-214-0x00000153713B0000-0x00000153713D0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3908-216-0x0000015371370000-0x0000015371390000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/3908-218-0x00000153717C0000-0x00000153717E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4036-302-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/4152-19-0x000001F383920000-0x000001F383940000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4152-24-0x000001F383F80000-0x000001F383FA0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4152-22-0x000001F3835C0000-0x000001F3835E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4216-279-0x00000000048A0000-0x00000000048A1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/4304-230-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/4308-44-0x000001DD303B0000-0x000001DD303D0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4308-46-0x000001DD30370000-0x000001DD30390000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4308-49-0x000001DD30980000-0x000001DD309A0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4356-112-0x0000000004090000-0x0000000004091000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/4380-183-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/4572-37-0x0000000002E40000-0x0000000002E41000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                              • memory/4868-291-0x000002137E630000-0x000002137E650000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4868-289-0x000002137E190000-0x000002137E1B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4868-286-0x000002137E1D0000-0x000002137E1F0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4984-334-0x000002BE75120000-0x000002BE75140000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4984-336-0x000002BE74DE0000-0x000002BE74E00000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              • memory/4984-341-0x000002BE754F0000-0x000002BE75510000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                              We care about your privacy.

                                                                                                                                              This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.