Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/04/2024, 11:29

240430-nlqy3abb7w 4

30/04/2024, 10:42

240430-mr7ckaab88 5

30/04/2024, 10:33

240430-ml1ylaaa67 4

30/04/2024, 10:27

240430-mhh9dahh58 4

30/04/2024, 10:22

240430-mefzvahg74 4

Analysis

  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/04/2024, 10:27

General

  • Target

    http://google.com

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ea1e3cb8,0x7ff8ea1e3cc8,0x7ff8ea1e3cd8
      2⤵
        PID:3376
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
        2⤵
          PID:2420
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2368
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
          2⤵
            PID:3696
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
            2⤵
              PID:3540
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
              2⤵
                PID:4828
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                2⤵
                  PID:3060
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4984
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                  2⤵
                    PID:1592
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
                    2⤵
                      PID:5184
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5420
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                      2⤵
                        PID:5652
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                        2⤵
                          PID:5660
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7594831027278560836,9363418402666227793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4852 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5924
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3936
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1824
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                            1⤵
                              PID:1516
                            • C:\Windows\system32\wwahost.exe
                              "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies data under HKEY_USERS
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              PID:1572
                            • C:\Windows\System32\DataExchangeHost.exe
                              C:\Windows\System32\DataExchangeHost.exe -Embedding
                              1⤵
                                PID:6188
                              • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                1⤵
                                • Drops file in Windows directory
                                PID:3760
                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                1⤵
                                  PID:5836
                                • C:\Windows\system32\CredentialEnrollmentManager.exe
                                  C:\Windows\system32\CredentialEnrollmentManager.exe
                                  1⤵
                                    PID:5440
                                  • C:\Windows\system32\CredentialEnrollmentManager.exe
                                    C:\Windows\system32\CredentialEnrollmentManager.exe
                                    1⤵
                                      PID:6404
                                    • C:\Windows\system32\CredentialEnrollmentManager.exe
                                      C:\Windows\system32\CredentialEnrollmentManager.exe
                                      1⤵
                                        PID:6612
                                      • C:\Windows\system32\CredentialEnrollmentManager.exe
                                        C:\Windows\system32\CredentialEnrollmentManager.exe
                                        1⤵
                                          PID:4028
                                        • C:\Windows\system32\CredentialEnrollmentManager.exe
                                          C:\Windows\system32\CredentialEnrollmentManager.exe
                                          1⤵
                                            PID:6640
                                          • C:\Windows\system32\CredentialEnrollmentManager.exe
                                            C:\Windows\system32\CredentialEnrollmentManager.exe
                                            1⤵
                                              PID:6512
                                            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                              C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                              1⤵
                                                PID:4980
                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                1⤵
                                                  PID:2140
                                                • C:\Windows\system32\wwahost.exe
                                                  "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  • Modifies data under HKEY_USERS
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5488

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  8d5e555f6429eb64461265a024abf016

                                                  SHA1

                                                  05a5dca6408d473d82fe45ebc8e4843653ad55af

                                                  SHA256

                                                  0344fd65882ba51695a10e1312e65f08d58afca83771c9d545e181829d6b5ed1

                                                  SHA512

                                                  be5edfdcda1ba0db9fbab48ee1b643f1b03821e24048892d18033094fec14171035179e987a08dd91a1c25d91d9256837a4105f6765afd225a868f3e95050b8f

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  b5710c39b3d1cd6dd0e5d30fbe1146d6

                                                  SHA1

                                                  bf018f8a3e87605bfeca89d5a71776bfc8de0b47

                                                  SHA256

                                                  770d04df1484883a18accb258ecfa407d328c32c0ccbd8866c1203c5dfb4981f

                                                  SHA512

                                                  0f868e4ce284984662d8f0ff6e76f1a53e074a7223122a75efa7bb90d0204bc59bee4b36c215d219a03707c642e13f5efce0c3c57f46659a0cb1e7fd2f4d3cf1

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  216B

                                                  MD5

                                                  cf2b7c09579fb35eb7ec9ed8d13c6308

                                                  SHA1

                                                  24e83d0c3a3d6a426304a8daf238f671430e4f6b

                                                  SHA256

                                                  992804781503d192c02de5451dd9101cc172ace25cba4476b12e16cb5fe37bc3

                                                  SHA512

                                                  8221eb48c02071d36288e57a7bb87b53e6ef8217c072ea359d562805f9c7e220eb61e569f084ff0a1fdd1256e152cb73de9d80e48cb248ccc9c0f9c4c314a36a

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                  Filesize

                                                  978B

                                                  MD5

                                                  9c025c7206f1b3013516fb059b6024e8

                                                  SHA1

                                                  18175f154f269118a46a6676264056b1c495b15d

                                                  SHA256

                                                  dedec9cc6c778d946142e997309c381119e908b91b30463b605679a72b59862a

                                                  SHA512

                                                  5a0798d3208662edac0e73e6842fc2e853a818a91b6e7adce0c72401640e51c2dbe947b742b8920071d83e88c278be04d9bf78f308722ceba293b1f3816ea4d7

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  ec4cc773a0c206f8f7796f8c7bf3b178

                                                  SHA1

                                                  73ef60c9baa3ff77f51e270fdaf1ed7e433de645

                                                  SHA256

                                                  f14244ecb425091c74d88ce89dbe18113a40bf8898a6bb6d41815e9b3c2cf484

                                                  SHA512

                                                  2a670e8fac20300db062497596b81cd5c91ae65026ee25490b1ec0986f1794190b3a405128da8a833a89cd94307ec6985b91b13d1e9a94e26108ce63d1de9720

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  10c0a80d9e1baaae48a17dfd83120c35

                                                  SHA1

                                                  104a7da30375aa542957e81ee12066a31a24795c

                                                  SHA256

                                                  fe2266ccec7e4d2c4bdeb34aa55accfb0e4d803940a8cd7028ec571caa50e3ed

                                                  SHA512

                                                  5c7762b2e478ef55002369552b69816698d3dce2b4fee105706f19b91095b9f1baa6a4fcaf27d5cfbf5799738adea3735803f13878b098e2722c679268fddf5b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                  Filesize

                                                  16B

                                                  MD5

                                                  6752a1d65b201c13b62ea44016eb221f

                                                  SHA1

                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                  SHA256

                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                  SHA512

                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  87177a99dd38bd22e31225aebe966b78

                                                  SHA1

                                                  508e633aa8f5686a76711f6b2f6592802d52362b

                                                  SHA256

                                                  ccec015eb5ac24a6d1a4f08ca5585b40730e253871900a3b5cbe2a9eff44246b

                                                  SHA512

                                                  90d89f1521bce25a7fa26d34834024f4097ad512c3875c91a8eb65875bc860ae47a773a906b72aa5151740928c32b8993eff9ec1449cf44545261693c9430cec

                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-30.1030.4980.1.odl

                                                  Filesize

                                                  706B

                                                  MD5

                                                  a7423d4373c88f57c434e04c0b681ab3

                                                  SHA1

                                                  7c87d9e058c5f708ca541c6b1a50cdbbcddcc08f

                                                  SHA256

                                                  e4a6948fa2648b1c7758f327155f8d2d33ab3f1284d3f0389c38f0c4ecfe0e2e

                                                  SHA512

                                                  73df043df0f60225d8156121f101e44f9f037b6861ebd2d03cb13d1dffc61d4cac6e3820067e16524d9db1b90ee9da97343347a8a1354389142ba6e403acfd2b

                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-30.1030.5836.1.odl

                                                  Filesize

                                                  706B

                                                  MD5

                                                  c77830ae1511a38618afdb74e59ac8be

                                                  SHA1

                                                  4800ae2f78165c03bb69bc675d8f873e25ed691c

                                                  SHA256

                                                  6ce879f5296b5c7d6599e48450386bbfaaef0868588114b2db9645e380a2c4e2

                                                  SHA512

                                                  d71edca8b191a8ca6ddd9bbdb7e034526ce8a47c955b7b8d46b6d1613c5c3b0910ea086a0d28e897bc6edba6c11b358f76ea00de0eea137c79b51dcbc3d0b873

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\6QXLVAVB\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  ee5c8d9fb6248c938fd0dc19370e90bd

                                                  SHA1

                                                  d01a22720918b781338b5bbf9202b241a5f99ee4

                                                  SHA256

                                                  04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

                                                  SHA512

                                                  c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\IRO8TQQS\datarequestpackage_h-_7C7UzwdefXJT9njDBTQ2[1].js

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  87effb0bb533c1d79f5c94fd9e30c14d

                                                  SHA1

                                                  4e4f5f3cddddbfddb46a1626d7ce579a639de389

                                                  SHA256

                                                  617e32ca57507098771fd30af6b9dcab063448f6d7e0bc6d6557dd1895f80543

                                                  SHA512

                                                  cb107c09f9a32d85bf2af714ee9bf7ce2649aa33e63c2255d4bbd281e3cda8fbdfa2e58212e8004aeeaab4dd8c94543f82187c7673189cacbdd5cd8c26c563f7

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\PL8D46DE\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  bc3d32a696895f78c19df6c717586a5d

                                                  SHA1

                                                  9191cb156a30a3ed79c44c0a16c95159e8ff689d

                                                  SHA256

                                                  0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

                                                  SHA512

                                                  8d4f38907f3423a86d90575772b292680f7970527d2090fc005f9b096cc81d3f279d59ad76eafca30c3d4bbaf2276bbaa753e2a46a149424cf6f1c319ded5a64

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\PL8D46DE\oneds_MC5gQfpbTUjLu60sQCwU1w2[1].js

                                                  Filesize

                                                  266KB

                                                  MD5

                                                  302e6041fa5b4d48cbbbad2c402c14d7

                                                  SHA1

                                                  66273c7a4d569c1c5e566d9bf15af4bae6beeb83

                                                  SHA256

                                                  6202c1621c9126a5089e97e5c1f092c6ebd2271875015564cc73957fd5e8b758

                                                  SHA512

                                                  c7af9f4318f7836de8bfa75f7546ec704255403aba5b1fee35025b0a1d821d813bc50d75f5db2aa6bc25df62aca0a4f6515511adb6aee4a1dfcba7689fa735d7

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\INetCache\XKI923U3\converged_ux_v2_nBE5FSqn9KpH44ZlTc3VqQ2[1].css

                                                  Filesize

                                                  93KB

                                                  MD5

                                                  9c1139152aa7f4aa47e386654dcdd5a9

                                                  SHA1

                                                  5ffc6a9e66220c6f829a8bd93eba584079852992

                                                  SHA256

                                                  2518655800698c89ae0bbc34b3b362c13e558bcb3ea4bd6c2cf4bbcf9e87b927

                                                  SHA512

                                                  cbe632cbafbe7282f951fac3f5079dfc658c583f6e93a1917527c749512ff8464f95ca37337e0bfd1c96b1cf3c6ada4a3b0db89e7947261e748c55603af6ec6a

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5KVVVIY5\login.live[1].xml

                                                  Filesize

                                                  13B

                                                  MD5

                                                  c1ddea3ef6bbef3e7060a1a9ad89e4c5

                                                  SHA1

                                                  35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

                                                  SHA256

                                                  b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

                                                  SHA512

                                                  6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

                                                  Filesize

                                                  115B

                                                  MD5

                                                  a19cd759b78f0257278ea48e6b417618

                                                  SHA1

                                                  2994a307e3609c3dabc52b7ea8a2cba0a0257a3a

                                                  SHA256

                                                  89e4e79a21e5bfff3794d477d0997c976a66eca9ad91276bb08c77efb9953cf1

                                                  SHA512

                                                  67f93708e83a73c52259503532ab9a46eacc67586080a4b1951f5e093685cd6fb26aed7218cc7d3b831f9afee0cd18c03debbbd8af6b71983c8a05b6ecada0a7

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                                                  Filesize

                                                  471B

                                                  MD5

                                                  0a0efb3590bf89299b2ab52994ae6a66

                                                  SHA1

                                                  0963be535b4a1abee0fd0ae77aaee6cc1f543df5

                                                  SHA256

                                                  bb2cd9921686f183de02d381e0c1c32b7eaef8181d0ca328dc197daa5229d1c7

                                                  SHA512

                                                  2dd6d7823e66802d6a504f27e7cc9b9acd3997cfe10e000453d258e8da6167fb424ab91bc179fa3558a114ca64d422532fe51bbde3af680cf080afa5b66ce250

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

                                                  Filesize

                                                  471B

                                                  MD5

                                                  f7775c96ab394fd259c17c2d4959e47e

                                                  SHA1

                                                  c6cc6e74b1c6ad5fc90741ee50b6c5e788f735bb

                                                  SHA256

                                                  082d69c7d262adebe38f3e8aac89d6cf04bf33550dc93a4fc4e51ddfe2f54ea0

                                                  SHA512

                                                  94d8f47d0ad4ad9a805f0ea1ef2b08ec992aad5a46840efce39d01709759df16999eaa651ef215097c38d6b1d47bf11fe87e99dff056069b6f190e4edad77a84

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

                                                  Filesize

                                                  471B

                                                  MD5

                                                  c3654d1242d1783f3b25482368dc65de

                                                  SHA1

                                                  df96727844a838e194eef6af01bed57e673215c9

                                                  SHA256

                                                  a884f697f2ab5dd3b90c088702fe8a98f0c1abd01f3f919721ba653dbc538e8d

                                                  SHA512

                                                  052d77654cb917904089637f3663460e240c82ed9ee73595e6dadc4d76dcd400fb8cdadce288acd7c7dd9e015a89802c3891b4bac47dcbc40a0fc1bd78fe294a

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                  Filesize

                                                  471B

                                                  MD5

                                                  95fc8cff68a40951f924a59acb66fc6b

                                                  SHA1

                                                  41997ac661b291aabe658a3256e8420c8500ca5f

                                                  SHA256

                                                  05d0dca2c63dab44ea0d9c49b444965f0e7d555611e6594cfced894c323beb45

                                                  SHA512

                                                  b6462beabe0bc56dad733ca56b099aca515282046df2c6c6180b2df4b294644ba09c61f2a5383fe25fc14a0d07eac0d7c94e1351dbd698b0b38594344fd9f721

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                                                  Filesize

                                                  404B

                                                  MD5

                                                  e880b3bfd6101243fcedb3e41709afbb

                                                  SHA1

                                                  bdf45ef567cdd3dc935c6933abd96b09b18e52a5

                                                  SHA256

                                                  196f152ee4dbda53ec52612234e3d9d22da5097de0f452e1d189f96d8bdc3f5f

                                                  SHA512

                                                  8a2378c4f4537818ade22e62d6d834caa2afec93068c870aff0d702f7988511d59957989da3fa449ea6b65e9f53eb47f601ca8607ab67dda98a4144893b7f4c6

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

                                                  Filesize

                                                  412B

                                                  MD5

                                                  39f28eb744e15281ffeddf569928c1ce

                                                  SHA1

                                                  358b95c33d4401848c21414dcf8cc61498f0f2d2

                                                  SHA256

                                                  675b7586e1889164a08c4cc1d31b1807d0b99a65b5c2965bebfd0554b1dbb3e9

                                                  SHA512

                                                  d5e547baae0a5d6a7149abfeae9db29ea043cb58a141e56e9129de39a9a464553d49e010151681c2afcee5773bf8e1dfaadb53fc3d19a78f5c037362c42b8ec7

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

                                                  Filesize

                                                  412B

                                                  MD5

                                                  81ad1edbfa23a87e60478ebbd0668d2d

                                                  SHA1

                                                  96ea191769688638ee018575a9b4f2a921712b58

                                                  SHA256

                                                  6a43b1b6f54849ac8a98dc88eb5c31e098fb9f353553ad00365f7d60d216e225

                                                  SHA512

                                                  25d62bcdaa8d3b230334371655abf10c64588384af7a4264dc73ab97f22fe83dea74c6a075ff03e66f3a96d15fd6b3a8beea124f6d285d7453e85ce0d9564ba5

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                  Filesize

                                                  420B

                                                  MD5

                                                  8036f1ea609a15be503c80b02be99e41

                                                  SHA1

                                                  385297af6b4fa5ec7e274ebe8e10988d99fe700e

                                                  SHA256

                                                  e879f7f9556b56dfdb0b31bd23bd0eefa45e9f70b2970de55a5f208d62b02aca

                                                  SHA512

                                                  ec57c40d87301883ab016149e662558f9c9f68fb56000cb8cc9eac0fcdbb56bcd00bf8ec5ff50471b8facd03d8e2005cb4d8fa3ef8f6364933a500c7c54764e2

                                                • memory/1572-571-0x000001D6AE810000-0x000001D6AE910000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/1572-549-0x000001D6AEA50000-0x000001D6AEB50000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/1572-1640-0x000001D6AF2B0000-0x000001D6AF3B0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/1572-1231-0x000001D6B2840000-0x000001D6B2860000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/1572-960-0x000001D6ADD90000-0x000001D6ADDB0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/1572-257-0x000001D69AF20000-0x000001D69AF40000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/1572-387-0x000001D69D580000-0x000001D69D5A0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/1572-1706-0x000001D69B990000-0x000001D69BA90000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/1572-404-0x000001D6ADA90000-0x000001D6ADAB0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/5488-2697-0x00000241E1920000-0x00000241E1940000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/5488-2109-0x00000241CCB30000-0x00000241CCB50000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/5488-2452-0x00000241E0080000-0x00000241E0180000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-2457-0x00000241E08F0000-0x00000241E09F0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-2267-0x00000241DFEF0000-0x00000241DFFF0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-2211-0x00000241DF9D0000-0x00000241DFAD0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-2219-0x00000241DFD80000-0x00000241DFE80000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-2672-0x00000241E2D60000-0x00000241E2E60000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-3099-0x00000241E06D0000-0x00000241E07D0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-3112-0x00000241E09F0000-0x00000241E0AF0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-3167-0x00000241DFD80000-0x00000241DFE80000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-2212-0x00000241DF9D0000-0x00000241DFAD0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/5488-2205-0x00000241CF300000-0x00000241CF320000-memory.dmp

                                                  Filesize

                                                  128KB

                                                • memory/5488-3300-0x00000241E34C0000-0x00000241E34E0000-memory.dmp

                                                  Filesize

                                                  128KB