Overview

overview

10

Static

static

3

kacperuxz#...eM.exe

windows7-x64

1

kacperuxz#...eM.exe

windows10-2004-x64

6

kacperuxz#...lo.ps1

windows7-x64

8

kacperuxz#...lo.ps1

windows10-2004-x64

8

kacperuxz#...lo.ps1

windows7-x64

1

kacperuxz#...lo.ps1

windows10-2004-x64

1

kacperuxz#...lo.ps1

windows7-x64

10

kacperuxz#...lo.ps1

windows10-2004-x64

1

kacperuxz#...lo.ps1

windows7-x64

4

kacperuxz#...lo.ps1

windows10-2004-x64

7

kacperuxz#...lo.ps1

windows7-x64

1

kacperuxz#...lo.ps1

windows10-2004-x64

1

kacperuxz#...lo.ps1

windows7-x64

10

kacperuxz#...lo.ps1

windows10-2004-x64

10

kacperuxz#...lo.ps1

windows7-x64

8

kacperuxz#...lo.ps1

windows10-2004-x64

8

kacperuxz#...lo.ps1

windows7-x64

1

kacperuxz#...lo.ps1

windows10-2004-x64

7

kacperuxz#...lo.ps1

windows7-x64

8

kacperuxz#...lo.ps1

windows10-2004-x64

8

kacperuxz#...lo.bat

windows7-x64

1

kacperuxz#...lo.bat

windows10-2004-x64

1

kacperuxz#...lo.bat

windows7-x64

1

kacperuxz#...lo.bat

windows10-2004-x64

1

kacperuxz#...lo.ps1

windows7-x64

1

kacperuxz#...lo.ps1

windows10-2004-x64

1

kacperuxz#...lo.ps1

windows7-x64

1

kacperuxz#...lo.ps1

windows10-2004-x64

1

kacperuxz#...lo.ps1

windows7-x64

1

kacperuxz#...lo.ps1

windows10-2004-x64

1

kacperuxz#...lo.bat

windows7-x64

1

kacperuxz#...lo.bat

windows10-2004-x64

1

Analysis

  • max time kernel
    32s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 09:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kacperuxz#7373 opti pack/optymalizacja windows by kacperuxz#7373/3. Windows Debloat/2. Windows Deblo.ps1
  • Size 2KB
  • Sample240222-lkbfwafg86
  • SHA256 861391286bc21b91fe404a6d5ed3cb36838daa37d99879d38c97e2c4d7c4b9b8
  • MD5 SHA1 SHA512
Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 36 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\kacperuxz#7373 opti pack\optymalizacja windows by kacperuxz#7373\3. Windows Debloat\2. Windows Deblo.ps1"
    1⤵
    • Registers COM server for autorun
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM OneDrive.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3744
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Windows\SysWOW64\OneDriveSetup.exe
      "C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3092
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /enableOMCTelemetry /enableExtractCabV2 /cusid:S-1-5-21-3844919115-497234255-166257750-1000
        3⤵
          PID:4256
        • C:\Windows\SysWOW64\OneDriveSetup.exe
          C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry /enableExtractCabV2
          3⤵
          • Modifies system executable filetype association
          • Registers COM server for autorun
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          PID:3644
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" load hku\Default C:\Users\Default\NTUSER.DAT
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:364
      • C:\Windows\system32\reg.exe
        "C:\Windows\system32\reg.exe" delete HKEY_USERS\Default\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetup /f
        2⤵
          PID:3816
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" unload hku\Default
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1860
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          2⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:392
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1444
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3024
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3896
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
        1⤵
          PID:5048
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4672
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4836
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1744
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4416
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1316
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4112
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1396
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4504
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4444
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4712
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4220
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4504
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4276
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:5088
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3280
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:2456
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3580
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2860
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1164
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3432
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4524
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3780
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:616
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:2992
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3832
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4348
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:552
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:1136
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1880
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:5092
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:2164
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:2116
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:228
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4988
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:1064
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4316
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:1700
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3400
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2824
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4884
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:2592
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4012
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2456
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4004
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3096
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4316

                                                                                                  Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        Uninstall-2024-02-22.0935.3092.1.aodl
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2024-02-22.0935.3092.1.aodl
                                                                                                        • Size 418B
                                                                                                        • SHA256 bdda0636244f0899b4ccfeb6627aea8b50157810c98213335fb8e0fcb9a574fd
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        Uninstall-2024-02-22.0935.3092.1.aodl
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2024-02-22.0935.3092.1.aodl
                                                                                                        • Size 7KB
                                                                                                        • SHA256 0f702c7a8c19f0dbdbee0a0d4ad1bf98ba2843ab09882f0a0ee928febb31615b
                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                        Submit Download

                                                                                                        Uninstall_2024-02-22_093524_c14-fcc.log
                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2024-02-22_093524_c14-fcc.log
                                                                                                        • Size 9KB
                                                                                                        • SHA256 de4d8994f2304e06251274bc4e09ebc4d157ce140a89db057a799e11fce487b4
                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                        Submit Download

                                                                                                        fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                        • Size 2KB
                                                                                                        • SHA256 4443e2bae05415122585d7761fcd1a227b05ab968e575273efdb0ce578723bcb
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        microsoft.windows[1].xml
                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\KFS6UHMN\microsoft.windows[1].xml
                                                                                                        • Size 97B
                                                                                                        • SHA256 2c8f11f2385e1dafe71764cdf3364d927522d7c38b98650493b7be3ea2470006
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        __PSScriptPolicyTest_ne044bxz.xxs.ps1
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ne044bxz.xxs.ps1
                                                                                                        • Size 60B
                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        aria-debug-3644.log
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-3644.log
                                                                                                        • Size 470B
                                                                                                        • SHA256 679743867e7d258e0b01dd6d52457afd4eb98bae5ef3732aa220e5bd11479f4d
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        aria-debug-4256.log
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-4256.log
                                                                                                        • Size 470B
                                                                                                        • SHA256 674f8febdcc84956154e8a6358aaff85bddc267bf46c83fb3e117eb90ba6b5f5
                                                                                                        • MD5 SHA1 SHA512
                                                                                                        Submit Download

                                                                                                        tmp61E2.tmp
                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmp61E2.tmp
                                                                                                        • Size 18.2MB
                                                                                                        • SHA256 cc66f067038cc23abd40c2c574a66bcf738c74a49d1832b3af90c853e349adc7
                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                        Submit Download

                                                                                                        memory/552-244-0x0000000004410000-0x0000000004411000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1064-291-0x0000000004100000-0x0000000004101000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1164-198-0x00000000046E0000-0x00000000046E1000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1700-298-0x00000235B5110000-0x00000235B5130000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1700-302-0x00000235B50C0000-0x00000235B50E0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1700-303-0x00000235B5560000-0x00000235B5580000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1744-102-0x00000232038C0000-0x00000232038E0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1744-97-0x00000232032A0000-0x00000232032C0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1744-95-0x00000232032E0000-0x0000023203300000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1880-251-0x000001B25BAB0000-0x000001B25BAD0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1880-253-0x000001B25BA70000-0x000001B25BA90000-memory.dmp
                                                                                                        Download

                                                                                                        memory/1880-255-0x000001B25BEC0000-0x000001B25BEE0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2116-274-0x00000242EBFB0000-0x00000242EBFD0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2116-280-0x00000242EC580000-0x00000242EC5A0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2116-277-0x00000242EBF70000-0x00000242EBF90000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2456-182-0x000001553D7D0000-0x000001553D7F0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2456-337-0x0000000003F10000-0x0000000003F11000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2456-185-0x000001553D790000-0x000001553D7B0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2456-187-0x000001553DBA0000-0x000001553DBC0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2992-236-0x000002D4D7B00000-0x000002D4D7B20000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2992-230-0x000002D4D7680000-0x000002D4D76A0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/2992-233-0x000002D4D7640000-0x000002D4D7660000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3068-11-0x000002E504EC0000-0x000002E504ED0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3068-40-0x00007FFFD4560000-0x00007FFFD5021000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3068-10-0x00007FFFD4560000-0x00007FFFD5021000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3068-12-0x000002E504EC0000-0x000002E504ED0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3068-13-0x000002E504EC0000-0x000002E504ED0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3068-5-0x000002E5050B0000-0x000002E5050D2000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3068-14-0x000002E504EC0000-0x000002E504ED0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3096-345-0x00000223A0800000-0x00000223A0820000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3096-351-0x00000223A0BD0000-0x00000223A0BF0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3096-348-0x00000223A07C0000-0x00000223A07E0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/3780-223-0x0000000004330000-0x0000000004331000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4012-322-0x000002921C860000-0x000002921C880000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4012-327-0x000002921CC30000-0x000002921CC50000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4012-325-0x000002921C820000-0x000002921C840000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4112-125-0x0000000004290000-0x0000000004291000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4220-150-0x0000000004650000-0x0000000004651000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4276-157-0x00000273D0E00000-0x00000273D0E20000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4276-159-0x00000273D0DC0000-0x00000273D0DE0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4276-162-0x00000273D11D0000-0x00000273D11F0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4504-138-0x000001B8D6FA0000-0x000001B8D6FC0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4504-133-0x000001B8D6BD0000-0x000001B8D6BF0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4504-136-0x000001B8D6B90000-0x000001B8D6BB0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4504-143-0x000001B8D6F60000-0x000001B8D6F80000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4524-210-0x000001F6C7FB0000-0x000001F6C7FD0000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4524-208-0x000001F6C7920000-0x000001F6C7940000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4524-206-0x000001F6C7960000-0x000001F6C7980000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4672-87-0x0000000004960000-0x0000000004961000-memory.dmp
                                                                                                        Download

                                                                                                        memory/4884-314-0x0000000004090000-0x0000000004091000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5088-175-0x0000000004540000-0x0000000004541000-memory.dmp
                                                                                                        Download

                                                                                                        memory/5092-266-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                                                                        Download