Analysis
-
max time kernel
37s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25-03-2024 00:43
General
-
Target
dcd19eee4fabb093e3e5fd6ed05c845c.exe
-
Size
283KB
-
MD5
dcd19eee4fabb093e3e5fd6ed05c845c
-
SHA1
b0c6823a142435c8f20455c83797b820a4bff5d2
-
SHA256
ce1b526bd03a7d5dd0c4d5803ae9c3c881de4f2229cae4e6c01d07c81b2a6541
-
SHA512
84d6cdb4bba43c5e10dc963e3b106d002d14b495c40f7dd02ce560d2d53ed4eef696849eac437dc38f2431f70b7388e91f3611a169384c82d88c755d192c4d67
-
SSDEEP
6144:y/aIitjKYKKiYkuKcuuiRahdoZ1oiAcYS+U7MyXP2R0:yiIitGPuKcniYhdoZ1gRSL7dP2
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 32 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 41 IoCs
-
Suspicious use of SendNotifyMessage 32 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe"C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exeC:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe startC:\Users\Admin\AppData\Roaming\0D243\9D21C.exe%C:\Users\Admin\AppData\Roaming\0D2432⤵
-
C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exeC:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe startC:\Program Files (x86)\43DA5\lvvm.exe%C:\Program Files (x86)\43DA52⤵
-
C:\Program Files (x86)\LP\1C70\6A2.tmp"C:\Program Files (x86)\LP\1C70\6A2.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\LP\1C70\6A2.tmpFilesize
99KB
MD59d83b6d4629b9d0e96bbdb171b0dc5db
SHA1e9bed14c44fe554e0e8385096bbacca494da30b1
SHA256d3a6060ff059a7724a483d82025a9231a61143839b633a6d3842a58ccb5a7d7d
SHA512301187bdcab5ca9942b2c7b7114e37e53e58b5661eef50c389622950d7691993a29f5a825132cf499ca73cdb6637d3f58afdc024cb04fac2b8e01f752209572c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD51912b0de9722581d54626ce20721f9b6
SHA1f412c2f35cfcb0136eb91da25a55c418df42b343
SHA2563bbddcc2d1995d3dc52f8085db9dc953da9a6035d528d44fd9ec800ab35a5429
SHA512b1621b61d045e649abbaa9d6cd50a7ba1a1a66422f1025fd3719aca30fc584976ec0ec2a0d7a16545c6b6d110dc99359db8a95cc7624bb2fe562854ab0a8ecd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD55cc8f3f3b23b2ffb049346c57467f954
SHA1caf9f4801e8b1a6ede5e06cdc8872671e9104ce6
SHA2566548ea48b21b61c133707f14fd9007f8bc18211848a63412a0a467c7b832b90c
SHA5123f71c3a383a8ee535f3c724ef589f09cdbc5ba012aee3dca41589fdc896172f45ea396ac22723db745d3447bcc08f07e7ff8fec006e000ffd4d9474cd2c484da
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD539e90217cb5dce5c52a79d78956befa1
SHA16a62e2e2e28bbf1768a94cb99c0ffef5eb97bcbc
SHA2562eed62db645bf338231ffd57913abe1449bdf2bcf2209a070770348ad2fb56b8
SHA5128c9c3bd7cf244cbda50f13eb89c2a3b817867363003ddeeb4bec117d171deda6f634afcc9974c6b45c514cdf58ecc42d1f183515ed4ed559051b958459822101
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133558010472881701.txtFilesize
74KB
MD580dffedad36ef4c303579f8c9be9dbd7
SHA1792ca2a83d616ca82d973ece361ed9e95c95a0d8
SHA256590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e
SHA512826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TV3VV50F\microsoft.windows[1].xmlFilesize
97B
MD55b984c298841d3dc3a3a0f8a819790bc
SHA127ec8f9f31d80734493d88e29e639b7562276867
SHA256c9bc2d8c025943515a1412a4cb84dd9c184b73031125619bf2cd2d2d2efc2d66
SHA512884209f3ea5207c6ad508975e139b2a16a6b861152c6861a3c1f1459973c896387e92407230ee1c90a6d4a9a49c52aa18d9d292b281a5b906f219280b7f15a93
-
C:\Users\Admin\AppData\Roaming\0D243\3DA5.D24Filesize
600B
MD5fe90f2cb9b87e2278f3a5fb7b67cbedf
SHA1020d5a7b99a299b72eb6768e1c14e42b4dcfc071
SHA256bab633e421c4da5e69d3998b6148ef0aea3bee3d1dc1a5617f5a330d617e8103
SHA512c029c2bec728fa439a36c7a9758c01983dc140c13db19c1be718d7dc2a8262116b3846da9a730eed7f0ca2c5d3c7f03236f487514f70eb1fbeac1d98ded48535
-
C:\Users\Admin\AppData\Roaming\0D243\3DA5.D24Filesize
996B
MD56aa0aabbb8ce2bfcfb8145147a96341b
SHA192ae5baf3ccff4c9a97ddd12c46140f0346ac0a0
SHA256f9d98c615ca509bfe8172ddc711b3d8028df4f3ddee87562e1a3f79bad21981d
SHA512d3e3f6cf67edb02852a8d807fb8de3bac38446529356f0a39242bf9c278ef64fd65fd5d721ff8f10937f619104ad149e408b5b66f7c1e4c493e5fb7161e431ca
-
C:\Users\Admin\AppData\Roaming\0D243\3DA5.D24Filesize
1KB
MD5f56c4853307d4941eaad730ed18836b7
SHA1610f49ad95f8dd43854cbb37096c6c27362b281e
SHA256a55843440c4e0a1d69fdd04402c00fbf1e186269c28160bf929a8027e3f4d59f
SHA5129839e4b72595d15443dae2973d39724deb42f5d4ed79f0263d5cf6ce01a0fffea5488671c9f8ef50a4c2cf69acee06ae2ca87d6148606bb7ee21cf09fe3fb774
-
C:\Users\Admin\AppData\Roaming\0D243\3DA5.D24Filesize
1KB
MD5508841d7533f7a6ced16a1375cdf8601
SHA165731d0b4b086c08a20c3b8db0b0d766bc663a68
SHA2567a26c805acf7bb1ec1aa0adbdbb65408bb720dc555c4649b1338177ff104b1e6
SHA5122714b7387e3188822fb7512c203784853f87e154f42d638f3ecf34433c8c760212fa29628c49fac0fcd577d4564cbca139a51ab0a4aeaa1c8d966e97a97d2c3d
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/320-431-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/448-113-0x00000000006A0000-0x00000000007A0000-memory.dmpFilesize
1024KB
-
memory/448-3-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/448-2-0x00000000006A0000-0x00000000007A0000-memory.dmpFilesize
1024KB
-
memory/448-296-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/448-115-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/448-254-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/448-43-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/448-1-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/448-217-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/536-117-0x00000000005B6000-0x00000000005FE000-memory.dmpFilesize
288KB
-
memory/536-116-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/1044-378-0x000002119CA00000-0x000002119E32F000-memory.dmpFilesize
25.2MB
-
memory/1044-369-0x000002199FB00000-0x000002199FB20000-memory.dmpFilesize
128KB
-
memory/1044-367-0x000002199F660000-0x000002199F680000-memory.dmpFilesize
128KB
-
memory/1044-364-0x000002199F6A0000-0x000002199F6C0000-memory.dmpFilesize
128KB
-
memory/1060-341-0x0000025EE17C0000-0x0000025EE17E0000-memory.dmpFilesize
128KB
-
memory/1060-344-0x0000025EE1DE0000-0x0000025EE1E00000-memory.dmpFilesize
128KB
-
memory/1060-339-0x0000025EE1800000-0x0000025EE1820000-memory.dmpFilesize
128KB
-
memory/1060-353-0x00000256DEC00000-0x00000256E052F000-memory.dmpFilesize
25.2MB
-
memory/2296-253-0x000001D0FA200000-0x000001D0FBB2F000-memory.dmpFilesize
25.2MB
-
memory/2296-245-0x000001D8FD3C0000-0x000001D8FD3E0000-memory.dmpFilesize
128KB
-
memory/2296-242-0x000001D8FCF20000-0x000001D8FCF40000-memory.dmpFilesize
128KB
-
memory/2296-239-0x000001D8FCF60000-0x000001D8FCF80000-memory.dmpFilesize
128KB
-
memory/2880-331-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/3064-231-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/3512-380-0x00000000035E0000-0x00000000035E1000-memory.dmpFilesize
4KB
-
memory/3600-327-0x000001F674800000-0x000001F67612F000-memory.dmpFilesize
25.2MB
-
memory/3600-312-0x000001FE77420000-0x000001FE77440000-memory.dmpFilesize
128KB
-
memory/3600-316-0x000001FE77A80000-0x000001FE77AA0000-memory.dmpFilesize
128KB
-
memory/3600-314-0x000001FE773E0000-0x000001FE77400000-memory.dmpFilesize
128KB
-
memory/3696-415-0x0000021B25DD0000-0x0000021B25DF0000-memory.dmpFilesize
128KB
-
memory/3696-413-0x0000021B26020000-0x0000021B26040000-memory.dmpFilesize
128KB
-
memory/3696-418-0x0000021B263E0000-0x0000021B26400000-memory.dmpFilesize
128KB
-
memory/3696-427-0x0000021323200000-0x0000021324B2F000-memory.dmpFilesize
25.2MB
-
memory/3992-198-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3992-133-0x0000000000610000-0x0000000000710000-memory.dmpFilesize
1024KB
-
memory/3992-132-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4100-230-0x0000000000680000-0x0000000000780000-memory.dmpFilesize
1024KB
-
memory/4100-46-0x0000000000680000-0x0000000000780000-memory.dmpFilesize
1024KB
-
memory/4100-44-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/4124-356-0x0000000004650000-0x0000000004651000-memory.dmpFilesize
4KB
-
memory/4520-281-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/4716-264-0x0000020D2B8B0000-0x0000020D2B8D0000-memory.dmpFilesize
128KB
-
memory/4716-266-0x0000020D2B870000-0x0000020D2B890000-memory.dmpFilesize
128KB
-
memory/4716-278-0x0000020529000000-0x000002052A92F000-memory.dmpFilesize
25.2MB
-
memory/4716-269-0x0000020D2BC80000-0x0000020D2BCA0000-memory.dmpFilesize
128KB
-
memory/5100-199-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/5384-388-0x0000021608820000-0x0000021608840000-memory.dmpFilesize
128KB
-
memory/5384-391-0x00000216085E0000-0x0000021608600000-memory.dmpFilesize
128KB
-
memory/5384-394-0x0000021608BF0000-0x0000021608C10000-memory.dmpFilesize
128KB
-
memory/5384-402-0x0000021605C00000-0x000002160752F000-memory.dmpFilesize
25.2MB
-
memory/5460-439-0x0000018FDFC70000-0x0000018FDFC90000-memory.dmpFilesize
128KB
-
memory/5460-443-0x0000018FDFC30000-0x0000018FDFC50000-memory.dmpFilesize
128KB
-
memory/5460-445-0x0000018FE0240000-0x0000018FE0260000-memory.dmpFilesize
128KB
-
memory/5460-453-0x00000187DD040000-0x00000187DE96F000-memory.dmpFilesize
25.2MB
-
memory/5584-212-0x0000015405800000-0x0000015405820000-memory.dmpFilesize
128KB
-
memory/5584-206-0x0000015405230000-0x0000015405250000-memory.dmpFilesize
128KB
-
memory/5584-209-0x00000154051F0000-0x0000015405210000-memory.dmpFilesize
128KB
-
memory/5584-227-0x0000015402800000-0x000001540412F000-memory.dmpFilesize
25.2MB
-
memory/5628-288-0x000001E78EEC0000-0x000001E78EEE0000-memory.dmpFilesize
128KB
-
memory/5628-290-0x000001E78EE80000-0x000001E78EEA0000-memory.dmpFilesize
128KB
-
memory/5628-293-0x000001E78F520000-0x000001E78F540000-memory.dmpFilesize
128KB
-
memory/5628-300-0x000001DF8C040000-0x000001DF8D96F000-memory.dmpFilesize
25.2MB
-
memory/5660-405-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/5752-256-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/6092-305-0x00000000042E0000-0x00000000042E1000-memory.dmpFilesize
4KB