8548e988763d5e3f81e0627ed3bc7684f7fe8c62d90c89d7899e0f16c0722ed8

Analysis

max time kernel
584s
max time network
585s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
store.html
Size 2KB
Sample240505-h7ev2aah9t
SHA256 8548e988763d5e3f81e0627ed3bc7684f7fe8c62d90c89d7899e0f16c0722ed8
MD5 ab1431bc85932c0ed73d21e7ad481d89
SHA1 c622099949f06187c137eb16a7fd65f08beb2b32
SHA512 c5a90547e4cf6e87625cc753dce5d79eab615111a92a2dc8c8b26323c757dcd1847577290493ce8a80486b1483e6a5d10061d6178f1e70c9bae76988240d2fac
MD5 SHA1 SHA512

Score

8^/10

discovery exploit spyware stealer

Malware Config

Signatures

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
2260	takeown.exe
3124	icacls.exe
3852	takeown.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2260	takeown.exe
3124	icacls.exe
3852	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BITLOC~1\autorun.inf	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\BLANK_~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\en-gb\wintlim.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\Assets\INDB44~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIE788~1.SCA\Assets\SECOND~1\Home\CONTRA~1\SMALLT~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNoteNewNoteLargeTile.scale-400.png	cmd.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\es-ES\ImagingDevices.exe.mui	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Functions\It.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\CLICKT~1\msvcr120.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\AppList.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\it\UIAutomationClient.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~1\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI1395~1.SCA\Assets\CONTRA~1\LOGOSC~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4E99~1.0_X\Assets\Icons\CamMDL2.ttf	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\clrcompression.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\AppTiles\CONTRA~2\MAPSAP~4.PNG	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\UEV\INBOXT~1\MicrosoftOffice2013Office365Win32.xml	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\keypad.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~1\ON9111~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\PHAFF5~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF104~1.0_X\Assets\ALA215~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HX6265~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\de-DE\mshwLatin.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIE788~1.SCA\Assets\AppTiles\CONTRA~2\MAPSME~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIE997~1.0_X\GAMEBA~1.WIN	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\MI3AEB~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~2\423x173\1.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\CONTRA~2\AP4308~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI46F3~1.0_X\PEOPLE~1.EXE	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\MedTile.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI5136~1.SCA\Assets\VOICER~3.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\Lighting\Dark\SILHOU~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\MemMDL2.1.85.ttf	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\SECOND~1\Work\CONTRA~2\SMALLT~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~2\ON21AD~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI67C7~1.0_X\Assets\SCF465~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNoteNewNoteLargeTile.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI67C7~1.0_X\Assets\SCA1CB~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\APPXME~1\CODEIN~1.CAT	cmd.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\1527C7~1.102\ACTIVA~1.LOG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\WEATHE~1\30x30\179.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID540~1.SCA\Assets\MixedRealityPortalMedTile.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\COMMON~1.UWP\Strings\et-EE\View3d\3DVIEW~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6132~1.0_X\Assets\CONTRA~1\APE65E~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\msosvgim.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIEACE~1.0_X\Assets\VO7320~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\de\System.Management.Instrumentation.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\AppList.targetsize-96_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\CONTRA~2\WE524F~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI17C3~1.SCA\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4E99~1.0_X\Assets\WINDOW~1\WindowsCameraAppList.contrast-black_targetsize-16.png	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\main\base_heb.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIBBCB~1.SCA\Assets\AppTiles\CONTRA~2\STOREB~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\_RESOU~1\11339F~1.RSR	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\CONTRA~2\AppIcon.targetsize-48_altform-unplated_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\COMMON~1.UWP\Strings\ja-JP\View3d\3DVIEW~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI67C7~1.0_X\Assets\FILEAS~1\FI7256~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\AppTiles\CONTRA~2\MAPSSM~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\APPXMA~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\OU0E3A~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~2\wabimp.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MID374~1.SCA\Assets\GamesXboxHubAppList.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIF4CE~1.SCA\Assets\SplashWideTile.scale-100_contrast-black.png	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\diagnostics\system\WindowsUpdate\ja-JP\CL_LocalizationData.psd1	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\sysglobl.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\InstallUtil.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.WorkflowServices.resources.dll	cmd.exe
File opened for modification	C:\Windows\Globalization\ELS\SPELLD~1\Fluency\uk-UA\uk_UA_bg_c.lm3	cmd.exe
File opened for modification	C:\Windows\INF\LSM\0409\lagcounterdef.ini	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Net.Http.WebRequest.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Xaml.resources.dll	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Power\es-ES\Power_Troubleshooter.psd1	cmd.exe
File opened for modification	C:\Windows\Fonts\h8514oem.fon	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~3.0\0C0A\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\alinkui.dll	cmd.exe
File opened for modification	C:\Windows\Fonts\app852.fon	cmd.exe
File opened for modification	C:\Windows\INF\rtux64w10.inf	cmd.exe
File opened for modification	C:\Windows\INF\volume.inf	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\en-US\IEBrowseWeb_TroubleShooter.psd1	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Video\ja-JP\DiagPackage.dll.mui	cmd.exe
File opened for modification	C:\Windows\Fonts\gadugib.ttf	cmd.exe
File opened for modification	C:\Windows\INF\c_fdc.inf	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC\msdtcprf.h	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\System.Transactions.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	cmd.exe
File opened for modification	C:\Windows\Boot\PCAT\pl-PL\bootmgr.exe.mui	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\IESecurity\TS_Blockpopups.ps1	cmd.exe
File opened for modification	C:\Windows\INF\hdaudss.inf	cmd.exe
File opened for modification	C:\Windows\INF\urschipidea.inf	cmd.exe
File opened for modification	C:\Windows\Installer\$PATCH~1\Managed\68AB67~1\157~1.200\sqlite.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state_perf.ini	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\JSC.Resources.dll	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Audio\TS_AudioService.ps1	cmd.exe
File opened for modification	C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\PerfCounters.h	cmd.exe
File opened for modification	C:\Windows\Fonts\cambriai.ttf	cmd.exe
File opened for modification	C:\Windows\Fonts\ssee1257.fon	cmd.exe
File opened for modification	C:\Windows\Fonts\vgaf1256.fon	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Web.DynamicData.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr-FR\WorkflowServiceHostPerformanceCounters.dll.mui	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Numerics.Vectors.resources.dll	cmd.exe
File opened for modification	C:\Windows\Boot\EFI\pt-PT\memtest.efi.mui	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Power\TS_DimDisplay.ps1	cmd.exe
File opened for modification	C:\Windows\Media\Windows Hardware Insert.wav	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\es-ES\ServiceModelInstallRC.dll.mui	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Device.resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Xml.Linq.resources.dll	cmd.exe
File opened for modification	C:\Windows\diagnostics\index\PowerDiagnostic.xml	cmd.exe
File opened for modification	C:\Windows\Globalization\ELS\HYPHEN~1\MsHy7es.lex	cmd.exe
File opened for modification	C:\Windows\INF\c_fsquotamgmt.inf	cmd.exe
File opened for modification	C:\Windows\INF\netevbda.inf	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.xml.Resources.dll	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\SUBSET~1\Client.xml	cmd.exe
File opened for modification	C:\Windows\Cursors\aero_busy_xl.ani	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Printer\TS_PrinterDriverError.ps1	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsUpdate\it-IT\CL_LocalizationData.psd1	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Xaml.Hosting.resources.dll	cmd.exe
File opened for modification	C:\Windows\Cursors\size2_il.cur	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Audio\TS_Mute.ps1	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Power\fr-FR\RS_AdjustScreenBrightness.psd1	cmd.exe
File opened for modification	C:\Windows\Globalization\Time Zone\timezoneMapping.xml	cmd.exe
File opened for modification	C:\Windows\INF\c_display.inf	cmd.exe
File opened for modification	C:\Windows\INF\LSM\040C\lagcounterdef.ini	cmd.exe
File opened for modification	C:\Windows\Cursors\busy_rm.cur	cmd.exe
File opened for modification	C:\Windows\INF\BthLCPen.inf	cmd.exe
File opened for modification	C:\Windows\Media\Speech Disambiguation.wav	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Workflow.Activities.resources.dll	cmd.exe
File opened for modification	C:\Windows\diagnostics\system\Device\RS_DriverNotFound.ps1	cmd.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "151"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_fr-FR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{BAE3E62C-37D4-49AC-A6F1-0E485ECD6757}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Katja - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Spanish Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{A79020BC-1F7E-4D20-AC2A-51D73012DDD5}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\L1041"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{31350404-77AC-4471-B33A-9020A2EDA1D1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\AI043082"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lts Lexicon"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Zira"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Female"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR en-US Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat.prev"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "409"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura - Spanish (Spain)"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = 49553b76dbc112bcd96e2ce32f82aa3750d88abb05779f5fac65e84c5363077e	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - French (France)"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\lsr1031.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - fr-FR Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Hortense"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{0CFAE939-931E-4305-8D05-8C76C254EB34}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40C"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hedda - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - Italian (Italy)"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "11.0.2016.0129"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\MSTTSLocjaJP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "410"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "407"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR fr-FR Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search\ = "0"	SearchApp.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3728	NOTEPAD.EXE
3024	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	NOTEPAD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe
Token: SeTakeOwnershipPrivilege	2260	takeown.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
4456	SearchApp.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3728	NOTEPAD.EXE
3728	NOTEPAD.EXE
3024	NOTEPAD.EXE
3024	NOTEPAD.EXE
4456	SearchApp.exe
3024	NOTEPAD.EXE
4456	SearchApp.exe
1692	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4928	2608	msedge.exe	84
PID 2608 wrote to memory of 4928	2608	msedge.exe	84
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 916	2608	msedge.exe	85
PID 2608 wrote to memory of 4912	2608	msedge.exe	86
PID 2608 wrote to memory of 4912	2608	msedge.exe	86
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87
PID 2608 wrote to memory of 3484	2608	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\store.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff855746f8,0x7fff85574708,0x7fff85574718
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15921790469217089083,6582558692219789126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15921790469217089083,6582558692219789126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15921790469217089083,6582558692219789126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15921790469217089083,6582558692219789126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15921790469217089083,6582558692219789126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\666.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\666.bat" "
1⤵
PID:2124

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\666.bat"
1⤵
PID:4920

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\666.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\666.bat"
1⤵
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5080
- C:\Windows\system32\takeown.exe
  takeown /f C:\ /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\system32\icacls.exe
  icacls C:\ /grant administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3124

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:5096

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:3048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\66.bat" "
1⤵
PID:4880
- C:\Windows\system32\takeown.exe
  takeown /f C:\ /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:444

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3895855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

History

Path C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 5fb649ffb193c35399abff8e11c5dc60158f4dda0c9501e94419e6e500815ea8
MD5 a539111a82b9a2fb50da11434bdcad84
SHA1 49b937054ddddf881fedf5d7f33553a6e7e10325
SHA512 5d544c57741113f4008cf03e42b99a66a7f01ae6e123edd1342cdb4157645c07c5f0379fc8fcd790e640ab3eebcf8d51b8b1f932c806890ba019d0a4dfbd3fcf
SSDEEP 96:xBm5U+bDoYysX0uhnyTpvVjN9DLjGQLBE3uKQ:xBd+bDo3irhnyTpvVj3XBBE3ux
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

77EC63~1

Path C:\Users\Admin\AppData\LocalLow\MICROS~1\CRYPTN~1\MetaData\77EC63~1
Size 330B
SHA256 3d0c2535ff86ca01029a39f164b59583a985c5fcf9ac823b90c6b447cab0789c
MD5 e55ac97677b8b6456150bdc4e206b573
SHA1 a9761321af3e3643dc80dec1931fca4921c2e28e
SHA512 2dcf77a6ca9e8d53fcb9b38adb16952662db70ff305796965cde2c94d70890b3b50eef14f0351951bea05e151f3c47444518674d0bae7e4e2e3de1a8bf027eb5
MD5 SHA1 SHA512

Submit Download

USS.jcp

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp
Size 8KB
SHA256 e3ab82c36b468b36dc652c67e54d565e2a145bb36781391f58446425cf7afcd2
MD5 b79da2e1eeada2da548088254a25b527
SHA1 d2c343d865844b34eeb73729b994efdce2df04d5
SHA512 fc81092dfc3227e72c4745741761793b70ba0beedb9ed9d294c0ab3ae701b6f3b53f52fcbc0d25f1565cae6fd651204848e309b445edd5943de6820421e6bf4f
SSDEEP 12:8MjWH2N1PqH2N1P2Rs4MjWH2N1PqH2N1P2Rs:kH2DSH2D+JH2DSH2D+
MD5 SHA1 SHA512 SSDEEP

Submit Download

USS.jtx

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jtx
Size 3.0MB
SHA256 7e902589e3b6caaa820f7e745109289f93050eb9ef708658563131c09c48d44a
MD5 4b7d446bfd267dbed1b4e92593786d6a
SHA1 98dcda1616dfe60c3f809d44936ed3849bab14dc
SHA512 e9b51434c682a7dbf72536cab8e83664c0dec26125d77d66d8def310f97f8c7ad87a15a9cdcb8f89e6599c17594a9382a9b8e3575ee841cf67f0ec14bca1bdb8
SSDEEP 6144:7PdOIwDHwGgAjqms4RiOQnVyteF9Z05J5qh+A1OTGW8AcWwVKciKsfvfH0ymMT8T:qRInG
MD5 SHA1 SHA512 SSDEEP

Submit Download

USStmp.jtx

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx
Size 3.0MB
SHA256 bbd05cf6097ac9b1f89ea29d2542c1b7b67ee46848393895f5a9e43fa1f621e5
MD5 d1dd210d6b1312cb342b56d02bd5e651
SHA1 1e5f8def40bb0cb0f7156b9c2bab9efb49cfb699
SHA512 37a33d86aa47380aa21b17b41dfc8d04f464de7e71820900397436d0916e91b353f184cefe0ad16ae7902f0128aae786d78f14b58beee0c46d583cf1bfd557b8
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

store.jfm

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Size 16KB
SHA256 2efe0146d5d89314a45cc38e68f5b09cb6a19f4c8e181da3eff9555bb1ac2514
MD5 139c637bfa96f555452937ab9099a67a
SHA1 7c49e20259275bfccc596621f515975c0a81faa8
SHA512 be5f42fd24969c2fdb91576d77437cb42176f89bbf269022819810520eb5c65f5b96ee589fc40d3c8b6bd05c991dfa99645f7ad275daab4b00b4a03a02d3d843
SSDEEP 3:noRtZZtl/tl++JlXlJ8ZiDf/XkdlklXloll:iDZX1E+JlOIkDkle
MD5 SHA1 SHA512 SSDEEP

Submit Download

store.vol

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.vol
Size 6.0MB
SHA256 768303f2e1e80784e72669c27e04f46b40d90c06377e791f6e651ec37c280d4f
MD5 a595aca8ed325dded78eb667d59d6d8b
SHA1 9112db2fb3dcb4180bd74cec91bc73e56c2dc2a1
SHA512 5d00f959774e7bdb201d6e3c3a43087967b80c2126f168e84640ff61df896a62015fa8a4b3ab72428ebff318011ca499e66a0b1fd2ca5c978262a648bd91a722
SSDEEP 3072:B6xJBXENWEp6mJUqT+Ka+d+gOrOuWxWk3m+uCtr5nf4mpRf:OEJoQa+d+gOrOuWxWk3m+u+r5nf4ERf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.edb

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\tmp.edb
Size 192KB
SHA256 86eafce1283179eec3d0f398541a006d9c6141e282b4f881a7467ef28cc032d3
MD5 0d5b9fabf29385a1b3b4198047c3c8d8
SHA1 ff3418780fd209922da3fb001508e55c067102f1
SHA512 e24ec581989787f28118dc6edf8d460eb10126b68a2437bf713ac23515724184984b01addb5f54c2cbbede0ad7bb5d810c9d5f4edc39a40dd7360979c98a7787
SSDEEP 3072:FL8uRIiFYLWOMpPH80eJr7UuR4iFYLWeMpPH80eJr7UuRs:CiFYLWTiFYLWF
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\Cache\data_0
Size 44KB
SHA256 46c94ab1f94fe1ed4e073e6d62eb1e022d6dd6c0c3637add7c502798613b08c0
MD5 adf7e9b3549e55a35c8d0094d5d3a99e
SHA1 f2c5a6f6d3c72d0385d164488dd8a1ec5da308a6
SHA512 74a716a38532cc8215d8514aa0d3ab42e5adaffb63ea1bae09f46d98d24c6f66eaf6560eb5f8e891df2094413cb7b0feda9f96714b38830f1643065ef74e788f
SSDEEP 3:MsFlYhXllLlX8lnVjy05l9H+flmI3ll/:/Fiz10Vv9eNmI3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\Cache\data_1
Size 264KB
SHA256 76e38a5cb68fbffecba7859cd1017aa8d0b0ae00858e7331279f8d454c73a56b
MD5 4278c1e35b7fc68f7209bb22c7d32d04
SHA1 fe8e1d18c66b64b5283788e09431b36b97dd42d3
SHA512 5b91fabe89b3d80f98dbd1ba153c63afa96374950ba4036f8ec2632ca93acf780a49da2145c7680ed7232ffecb13860629073abfae84ebf9ba428e044c0e6bae
SSDEEP 6:/M/PXGuEVtkXN2zhmw/Llc3DOfET08Nsq0hy9h:U/PXKsum6l+MEg8Nh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\Cache\data_3
Size 4.0MB
SHA256 6399c64a18570b120d0675c841da26e049fd559406d7aebc30198f56548fcc17
MD5 ebf59f5febd6962bc2b158f6188d1280
SHA1 24b1fe5d56c7cfba2052e516c5f6e00ab3035fc8
SHA512 04d2e0aa69ec2c0c8eed1d1fff2c3cd7877cc39ac85dde45497beab3b7e72d0270223d1f24c32bbafdb8d9926d77c32d2a7eb187170d459ff76c9e98872487cb
SSDEEP 192:Oy87XdvFIgO2xwOTxExs7xPItgIZPzp6H9TiX+NAt7j7MLw:Oy8LdNI9INJ94gIxde9TiX+Ne7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\EXTENS~1\LOG
Size 322B
SHA256 3349cc0f9bd6ef7b00f9eb3ae6213dcdcefae14d3dcf5e96537a568f1c3f942e
MD5 8b9a6f30f95053208658ff46c4c7ab5f
SHA1 0628f5f6a5fc1cc6d4ded71185c8f1370de5e3ee
SHA512 151ded623bafc3a50fcb16b6a02bbccc92310069dfae5a69a6bb7acffe391f000b48c83a55fe0bd716737088d9d8eb6010fba879a3f1e92b16e6ffde4cd92a91
MD5 SHA1 SHA512

Submit Download

HISTOR~2

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\HISTOR~2
Size 601B
SHA256 3855c6ea43b7e3ccdd428dfee60404fd643399836f787b64a6637a4b23ed68e2
MD5 4c3325414771b7483cfe2d4b2ad921b2
SHA1 e944907482f69f392a2db039c58afa4311933000
SHA512 1696b12f99f9425515a7447fa4160cff0f1609037e4c326ee3306dcdb68dc2e37e069d2970cdf36b6f95a28c48a05c454acac9ebd304eb0797ba6f0c6c64856a
MD5 SHA1 SHA512

Submit Download

LOAD_S~1.DB

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\LOAD_S~1.DB
Size 44KB
SHA256 a711c4a1f0fa17ddd6d82125951ce71e5a3dd91e72b72e554bc49e1890b33624
MD5 08ca77f2ef8e97598c1ee4374f4da257
SHA1 4269056c19cb1d07f715c74642168216a5c9a3d9
SHA512 54270ccce9b222e320612c5ba6aa9a003917d39215b8ae374f2b1a30d8695e865393ccaa9232e1951e332c777218ecdfbcd162d782de3ebeaee23060a0d9033d
SSDEEP 24:TS4UYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy8wbxnlhygZhy4pcI5fc:TtUYVAKAFXX+Rhy6hy4pcEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\LOCALS~1\leveldb\LOG
Size 331B
SHA256 2071bd6da2e6912a878017c1b288acca3dab504fbdcad6e76b14ab8ab6c3ff7e
MD5 b30590b891e0e92e9785a7e393e12755
SHA1 90998e7b6f00dd475799766cc17abca54e811acf
SHA512 e930fd84efaa9cfd4ea9dff549f578059f24fa4faf8834bbebf44ae20a5104df830a98d93f6ffe217411d78611f9db60d2ae7ce0150f35a1a776d746214e4221
MD5 SHA1 SHA512

Submit Download

REPORT~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\REPORT~1
Size 36KB
SHA256 a5e0bdd37ed8dc92e2e847bf70276d54be846fbd0dbfd41d5d8ab5adf35f02df
MD5 a9e57c48cb6ceeb268a1c0b2ad8bae15
SHA1 1c9f5fc25645b108872da304aed1d2b80f3be63f
SHA512 3d7468d77d1cc02dcc9091186fa7e6516048df5f421dfb8daf0aa39e251968b360aa337752326a5ae732d0940aa52be77a018e08e247e2be86ec53581803f5e3
SSDEEP 48:T8IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBiU/:gIEumQv8m1ccnvS6iIL
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\SESSIO~1\000003.log
Size 118B
SHA256 b10c1ba416a632cd57232c81a5c2e8ee76a716e0737d10eabe1d430bec50739d
MD5 7733303dbe19b64c38f3de4fe224be9a
SHA1 8ca37b38028a2db895a4570e0536859b3cc5c279
SHA512 e8cd965bca0480db9808cb1b461ac5bf5935c3cbf31c10fdf090d406f4bc4f3187d717199dcf94197b8df24c1d6e4ff07241d8cfffd9aee06cce9674f0220e29
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\SESSIO~1\LOG
Size 319B
SHA256 c7ec0e054a314dd5d981f429318e2cda084c3146b021f0bfd5892551f6c52c7d
MD5 215e39ca1b6253e2a552f33ee74e65f5
SHA1 8ebeb9ec7cf2a2dadf2cf0a38a6c58dd40157b1b
SHA512 dc6c05645320c11eca797c83310c491ea7e48a62be1bda3a1e0db828ffb31e223e7a76b3159f8d783f9345d579df07644620623da942a6ca3c550c89ea4ac413
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\SHARED~1\LOG
Size 319B
SHA256 c0cad1a5e9c83a3e315380c5a62e529193852a0e94d873c39816629671637885
MD5 0ba23486d0916fb30105aad06953a39c
SHA1 eb790d6ac7aee14999e9b816e6000525bad792b9
SHA512 e1d80f5928e8936f9fe824623b8e3681769465a8052b166cd7ebdbd3ad7f05783c7fc261ed974933c302003e152f9c4c00c69771e9a2de604e76b0e94a5e44f8
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\SHARED~1\metadata\000003.log
Size 160B
SHA256 2eeb6d38d7aad1dc32e24d3ffd6438698c16a13efd1463d281c46b8af861a8ce
MD5 2e19a9040ed4a0c3ed82996607736b8f
SHA1 5a78ac2b74f385a12b019c420a681fd13e7b6013
SHA512 86669994386b800888d4e3acb28ab36296594803824d78e095eb0c79642224f24aca5d2892596ac33b7a01b857367ed3a5e2c2fb3405f69a64eb8bf52c26753f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\SHARED~1\metadata\LOG
Size 337B
SHA256 ae0f935787522f3eb8d0b8dad7cb8ca97c27622929a7d1149fbb5e5e0b675bed
MD5 6dc7daf59d320cf6f59ce423d87653e1
SHA1 f705f77b5fa71f51d883bd8f027ebf0d04b5a4f2
SHA512 82725928f6815c224cbf2ee7fbd19754eb85e4b2b2ed2f6941505592cd13e8d1d4789e8df2599d685ee379f02a889de54e7d9383ead9cffda383fa0e0437e49f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\SITECH~1\LOG
Size 347B
SHA256 ab1e933c689707fd5ab532a55ca55b3c879bdfa38597a894aab24f8899d15d08
MD5 78fcfc3aaceb91e658ba16f0a4dd1e33
SHA1 c4e3b6c62e90042f340e5f6a94ab15358466d041
SHA512 ed1e0366369dcec59c67087bfed7dc624415508c41a9914b5a3a0272de7f942fa48e5a9458dd11d9d4ef5ee5ed5c83bbf022b2fd5236f5f343c45a6d587dea10
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\SYNCDA~1\LevelDB\LOG
Size 323B
SHA256 af92370bce6d04f5bed442bb5c5910eb560ef1446cd3d1e8b0e263dc6432fcc8
MD5 e504ddd6e3f471b2013616cc9712d1de
SHA1 7d2bc339e62c671056b4ab18a2b292f8b75b9776
SHA512 02236f351519aa9fc1e18b5d11c0506e6809d5dc138ec0284a3672077204f713f72bd8c4f59b03e8820355c0659b3ada6b1c89d1a44d8daa34c958c45334f209
MD5 SHA1 SHA512

Submit Download

SESSIO~2

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\Sessions\SESSIO~2
Size 1KB
SHA256 c94ed3e5fd8a0f386a42e277eb998ec2e7ea4577b47735640f7f20eebadd2966
MD5 f707df7cf29b82f757cf21b6978fae58
SHA1 5e032c01757d08e7da677ee91a584261cccd2608
SHA512 4b58a4801c9f481837d3ca4e7d49cfebc4b6f48b17f8c7ab6ab06d2127c42497c2877b4a3e8332d570ba3b9ed8b3de71687fc191291c45a5dc39afbf03ac4f71
MD5 SHA1 SHA512

Submit Download

TABS_1~2

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\Sessions\TABS_1~2
Size 1KB
SHA256 c789b67f0307b0c798b0d3e718162e8bf9368d47db57aa870ddf59918a4bdc6e
MD5 1dd4fb356b864bce1c03cd68da15e2cb
SHA1 c91c035eee0e3ccb844279abfa57e7b6700819f8
SHA512 2654e05e165f9413978f5ab2543652a089fefe2143c686f1ab539c24a32cd52e3ff0c7b6e9d5ab7a894389779c68e539213a1eddbe1b6db553259fb4a734e877
MD5 SHA1 SHA512

Submit Download

TRANSP~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\TRANSP~1
Size 204B
SHA256 ae9364f805fb560425c380cc191d68ee29c04dce15ec0c4dd78125d681df3202
MD5 96dc66db84e0741084295df2e5737566
SHA1 d6273822bbc929b826fb3df6c6b5f84340d3c979
SHA512 b27b41c850fa45e76503c1b1f9c38af8edebfd720f224dbd147e783ad0d0e358525135f3178a6ab616adab843abe826fe2fb662faf2390f02391dda52a3e16c5
MD5 SHA1 SHA512

Submit Download

VISITE~1

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\Default\VISITE~1
Size 128KB
SHA256 4b834801ba03da25e3c81e30c6730d76853deb08887f1a28ca0336ef319d0cd6
MD5 2f53a09acd9c6ee69740aaf3630be3fa
SHA1 be1a3daed4fc252229c8545733588e69390b55b8
SHA512 2626b5d179ff4f25843aa23d2daed76d04b292f5b3749b76b576b7ec98c88a81ce1d567ecadb2b6ec54aba964dadfef24f9e754933a02b3efbeec38808f59549
SSDEEP 3:ImtVuDXh98YRll:IiVuL3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

EDGE_S~1.TXT

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\EDGE_S~1.TXT
Size 4B
SHA256 d205436bc0733e8ef55748761e1c211b7e150fb0c53fd517de890521bfc3c62f
MD5 68c78cb25d0edebd74776f0432d62960
SHA1 643f017527e8cd70d54f5eb4d4714a2dca574306
SHA512 ab1a2b25c7dd7e87c2e03406d6f9fb9b306414d0962f577792613dde18247589995970d2781e6fc447b8b5265611eb8d8dda12e7b6d43d91c2b0228c16d46159
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\GRSHAD~1\GPUCache\data_0
Size 44KB
SHA256 73127dac74fad09781bd7f1ad24cdf1f7c925cd22c3294e8c556bec8a2f26718
MD5 43120be96f8c5f9bb42f305901e6c7d3
SHA1 fe432058012b29f979db295d499f1c9c0c7e4de2
SHA512 4fac30e0b78030d28e43faddd317bc85fc3a75ad55b381f8fc0c7cb44465cff790ac101eaf2af1eba26317aa1276561ad305d8fe41cefe2148ca9dd9fb97a4be
SSDEEP 3:MsFlthltlluto8mikM/lpa/Gl7lH/1J/lq9o177//jCKdvKFsP+Mta:/F8to8mikM/l0u5lf/l2ox/jC6LmMta
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\GRSHAD~1\GPUCache\data_1
Size 264KB
SHA256 c204abb844a50108fe02812efb5373b614a88612fc0aeda638c18d0030f993e6
MD5 2a8ac325c8f646e32db00a2c74d98a95
SHA1 e9e039859aaa7a506f7e93dc317dbd77fc08e2ec
SHA512 a92da2ebe02c266a8c9dba46f1c062c71f3a2342b91d388a81c77398f0848bb20456407f8b6bb2c18aee43b6acb42d6e11f1658654e7eac6f2482315bf28e0c5
SSDEEP 24:GH2BzBQCxSNOzAeqzBQCxSN0Kx8zBQCxSNf5zBQCxSNAl:PByYSNeuyYSNuyYSNf5yYSNA
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\GRSHAD~1\GPUCache\data_3
Size 4.0MB
SHA256 a3b153833effad5b4862470c6e5ab0909056bc7aae657b5725c9365bfbfb709a
MD5 863545d297d288d09e15f85d31d50718
SHA1 78c2046e11746a63bec4997090671573d91456f9
SHA512 531a2d4d91ac2c3dc9d6e2b70330d7516e544094f923cf9f8669493e9c35e61dab7a531c7f4c5fb0d66a532b647ded24d859a894a13b401e19a82730273bd2b1
SSDEEP 768:d1IBi2v0LpCMQD7LFTrYB3DHI/iz6JW46nMpK:fI82vNFtYNDHmJl6z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\MICROS~1\Edge\USERDA~1\SHADER~1\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

9CD93B~1.TBR

Path C:\Users\Admin\AppData\Local\MICROS~1\TOKENB~1\Cache\9CD93B~1.TBR
Size 4KB
SHA256 d83e393dd0b5ab70cf490c608996068fd11799770f904d653ac112819cd298d2
MD5 0483bb1e0e86ad4d18d36953d99a4c99
SHA1 d22237913700342297a8ecfaf55d8d7e824d17f0
SHA512 672060ae941f53fc3802c3db68b7eb75c9eda64cf4f31e3b98a9be8ca74029f589a907814618410497c415d946037f7b9667a17608f10a0667cb081762d5c3ee
SSDEEP 96:IhYRxivplM3ohsXKcjVdTV8cOik+epV8SsbXGA4YDbbFRJg:Ih5vpi3ohsnD8cOLoV2A4anr6
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
MD5 2a70f1bd4da893a67660d6432970788d
SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
MD5 fbe1ce4d182aaffb80de94263be1dd35
SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 188B
SHA256 376006f8fffee91ede6e6367fc46a81ad97568e59ede6bfdc1aba6420294d6d1
MD5 9e60751db3c2c5b6a54f6cb18f9a387e
SHA1 c3815742501bd3eb5456958d253c57fa48f14451
SHA512 e25d565bc4a56dcdb10bb2eb9daf4b031746652cfa55658f35331bc72b0dce59861fbb0a3923857a0382e1b0ef6f38022b13f34e84133567f37872738b12aa96
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6ad77f00e1fd96c89ed2bfe2ef6063fdd105e12b8f2a326e946681357d39826e
MD5 5b29c4a291a4154d996267094ee4bd51
SHA1 82227be1eb75d62f38fd8311823e6ea8613a6cdf
SHA512 215bdb4ffddcb10c4d37f36550d246ae90eb00d2cd8f67564b087712cd885b0b3d21c5d4f1e849e83066936db0ae934f7c1f22d240717023b8e53197e5f1b661
SSDEEP 96:nukPe1w6niK1wpvWMoiVmdeHdt7GUWQyV+VDCziEwb:nukGW1kGWMXbSro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2776385db5c7f0abbe6846846445e12e531e2301d73874560fd754893e459e13
MD5 7c00668e2fdf7ceaafa0a7a951704ffe
SHA1 c2146854c0f6b493bc2bce1d57c50952ab9ac63e
SHA512 865a11fcd0d1853d57a712f5b1953f9d2dc74eedc5b5dd147561560da8851126ee3b7629b8b4bf8bd0dc0911959bb9fe4620e2faca8620e24b350adf2eb64dac
SSDEEP 96:nukUAe1wWniK1wpvWMoiVmdeHdtoCyWQyV+VDCAiEwb:nukUbWpkGWMXbnlV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 597f0dd75e3d753a8c5aa9305516d18cbac8e3a7f8948ddc143ac6dbb541c178
MD5 2ef54af3c5e5dff356699c2f9327e6fd
SHA1 99a5e2505da4e1b41de1755f506dc7c4d0c6fb1f
SHA512 34b500e42ceb62c0db2ebce0e3abbbc092a8529123fb0193878ae5719daa75d79d507ded2abb715d9d2b35bdff60717d200f2487364d432ab1040430772985d8
SSDEEP 96:nukme1w6niK1wpvWMoiVmdeHdt7GUWQyV+VDCAiEwb:nukVW1kGWMXbSrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bc9aef550f7aab8c1097d0c66013fa52ea727dc703c12ac32276b78f9e82ee0b
MD5 97f0676387c0a56337aabb66ae854865
SHA1 e31ff05477f67c3b0a815c45b3448f873f1f03b0
SHA512 2d6f9229bc4b89774e29a98e605f7bea7aaae24ad5b77a02c06766941b1a1deb00da8fd674dd74f57716dfa5d3a2935435f887e42acc5570ecfb509354938c1f
SSDEEP 192:EoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxBcxe2RUZOiF+OblfBhDaz:k9iIxuERzA83h09RZxYKQF/XDafEBjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ebdb57a432fb425a3abeaf570152501fc42896d48e6b9b8788bc2f8faacf7363
MD5 0e781dfd1965ef10050b0bb8726e8a84
SHA1 aba1f7e2ef4d87f1931de626da71a0121b56d1be
SHA512 40bc0e4cc096b7deeb1e3964361413d3136a02dfcce07725cc134a459c77e2e1b2c633cab4a75d38ea53ddb8a50bd6d70571af53e17a7e51853affcf49a3c37a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxBcxe2RUvOiQ+OblfBhDaz:A9iIxuERzA83h09RZxYKYQ/XDafEBjI
MD5 SHA1 SHA512 SSDEEP

Submit Download

80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Size 471B
SHA256 0b2a09b40bbac88b2c0c59bd79a670ab4e51404cd609213a9799967dee84f73e
MD5 2792c89a010553aad89c7bcdd9a47468
SHA1 91703a9af32c92ad58d6149bb025c6fc09b4aa51
SHA512 9d008e1ed8ec996238cd06bd92440aab5f72bfe36d316ba95d14476b20e645fa9fac6bebdea580dbac9a8f8dd3d736a544a7349fe3ed7e6f9ddb9d43d0fe3be2
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Size 412B
SHA256 6deec4c806a71c316b3194ec01f5bf5d374c95e1b40a01aa71d992538381bc97
MD5 245998d692179f2f08624dbdd2c2db76
SHA1 b1cb381432d1fe8bf9adaf568560c2c40b5bee65
SHA512 9fe113e1a3f50050b19f9fd46f79a78b7202a14927c7e76c52fe198966192956af8149a7a10d3c3c69611d62f453280c72647f26c0acabc0669e741d86693a5f
MD5 SHA1 SHA512

Submit Download

microsoft.windows[1].xml

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8FNHO0BC\microsoft.windows[1].xml
Size 97B
SHA256 6f795329f182099f53f65bb4499dd8967dce247953405c33bd0ae5e88628eca8
MD5 3acb46e5746788f589f6895d064db0cd
SHA1 a5477df9438eec35a65f7f3522c3f2424cc5c126
SHA512 2d20b5255e67a0ed59153677aed1d950dff1bffda8888f09a57d68353d5c47ca62a168176833a39bd93cceb1baa03fd0bd0009adf7e78295d043d257c1393e4d
MD5 SHA1 SHA512

Submit Download

https___java_com_help

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
Size 36KB
SHA256 a3273cc3378123d6670a231700cb8a1ec161f8c42a49b245c173db31ef1b997e
MD5 e42ac5c8e552fc39d776eaa7cb7ff168
SHA1 028f9ed87f403ea61ff56378aabf9ff8b6866cae
SHA512 5bf4893bd298f55fd459c07cddc21ec124244ea97f351c8a3a3303ac49c5dc30ed335698c7927ee30a183b1bc15e740dd6ea217f2db80a878fe635549d777a90
SSDEEP 768:Xmmmmmmmmmmmmmmmmmmmmm9KB0OVwGMJdx7b8NEViF1CMui9iJ00BJafYYXenofK:sPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe
Size 36KB
SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
MD5 bad093419be1135cfe9694ea77088c78
SHA1 76204c7ca72cf666add9c9931389d635c82e8af0
SHA512 3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d
SSDEEP 48:jDlmj1hraax2DvfG+ohTrNAg4eBDAudJ4hKO2I7dQOggBYiiqD1yB72G6nBRz9iz:jDlU1hUol9onbdaa/aarIkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.0.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8ba6ec17-02b0-45c1-9351-0befcf066858}\0.0.filtertrie.intermediate.txt
Size 28KB
SHA256 373bb433c2908af2e3de58ede2087642814564560d007e61748cdb48d4e9da3f
MD5 ab6db363a3fc9e4af2864079fd88032d
SHA1 aa52099313fd6290cd6e57d37551d63cd96dbe45
SHA512 d3d13d17df96705d0de119ad0f8380bfe6b7bc44c618e2fcd0233061a0ab15beae44d38c48a880121b35f90f56c1529e5f4cf1a19acb9e2cbba5d1c402c749c0
SSDEEP 768:+/ECewchqEZDgApzsdGByMVyNAaFHzDikj9HJjI:tv9R1z3/VyNA+3nj/jI
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.1.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8ba6ec17-02b0-45c1-9351-0befcf066858}\0.1.filtertrie.intermediate.txt
Size 5B
SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8ba6ec17-02b0-45c1-9351-0befcf066858}\0.2.filtertrie.intermediate.txt
Size 5B
SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
MD5 c204e9faaf8565ad333828beff2d786e
SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
MD5 SHA1 SHA512

Submit Download

Apps.ft

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8ba6ec17-02b0-45c1-9351-0befcf066858}\Apps.ft
Size 38KB
SHA256 b1557167a6df424f8b28aabd31d1b7e8a469dd50d2ae4cbbd43afd8f9c62cf92
MD5 84ac0c242b77b8fc326db0a5926b089e
SHA1 cc6b367ae8eb38561de01813b7d542067fb2318f
SHA512 8f63084bd5a270b7b05e80454d26127b69bcb98ec93d9fad58d77203934f46b677a3aaf20f29e73dcd7035deb61f4c0aa3b10acbc4c0fc210632c1d74f705d2f
SSDEEP 768:PDjYPohNf1J/Om8Vz9JWxXVoVPPPw4XOWocHE:PDjYPohNf1pOm8B9JWNVoVPPPw4XOjgE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apps.index

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8ba6ec17-02b0-45c1-9351-0befcf066858}\Apps.index
Size 1.0MB
SHA256 43da4fa5f62affe399ceaac2d489b7cde610963a48e72d445bebe6f2c63a3600
MD5 f4514c93191e0efc0f61036e4ebb341a
SHA1 c80478e9a734790c18584f67a43518aa4a7dcf58
SHA512 8aecb3491767e040a52f351908004db2c8f2f083397744585c2832212ec8aa288d3492be941a48b04774e16b43672ab167209776cbdef6692fef684fc54666a6
SSDEEP 12288:MxmthXv3zrLoE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSK5:AoLr7YfoyFxz8GfoLr7YfoyFxz8GWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

apps.csg

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c84f0a00-5d22-4ea3-a716-d9917c5ad51f}\apps.csg
Size 444B
SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
MD5 5475132f1c603298967f332dc9ffb864
SHA1 4749174f29f34c7d75979c25f31d79774a49ea46
SHA512 54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff
MD5 SHA1 SHA512

Submit Download

apps.schema

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c84f0a00-5d22-4ea3-a716-d9917c5ad51f}\apps.schema
Size 150B
SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
MD5 1659677c45c49a78f33551da43494005
SHA1 ae588ef3c9ea7839be032ab4323e04bc260d9387
SHA512 740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030
MD5 SHA1 SHA512

Submit Download

appsconversions.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c84f0a00-5d22-4ea3-a716-d9917c5ad51f}\appsconversions.txt
Size 1.4MB
SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
MD5 2bef0e21ceb249ffb5f123c1e5bd0292
SHA1 86877a464a0739114e45242b9d427e368ebcc02c
SHA512 f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b
SSDEEP 24576:A5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMo:AMVD4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

appsglobals.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c84f0a00-5d22-4ea3-a716-d9917c5ad51f}\appsglobals.txt
Size 343KB
SHA256 541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e
MD5 931b27b3ec2c5e9f29439fba87ec0dc9
SHA1 dd5e78f004c55bbebcd1d66786efc5ca4575c9b4
SHA512 4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd
SSDEEP 3072:+rNHn+auvNDrohmXLI7E8FAtXQkun1907JL6hq65sRQsqbmfEV+1+b:qNH+auvJohmXLIQfhI1YL6hB5PsqCfU
MD5 SHA1 SHA512 SSDEEP

Submit Download

appssynonyms.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c84f0a00-5d22-4ea3-a716-d9917c5ad51f}\appssynonyms.txt
Size 237KB
SHA256 2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1
MD5 06a69ad411292eca66697dc17898e653
SHA1 fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d
SHA512 ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693
SSDEEP 1536:ek7gHR0SV2zp+MK2MHYAb8hqahIBAgoEA6YoGCmrzzB9C1D48fYMLZB1QMX+Z6pL:RUx2kBFeDb9YiAlP+zCmTXFePKG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133593676413607486.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133593676413607486.txt
Size 73KB
SHA256 ca7a49706055df15b0d7f15795ca9846c18f76f20ce135c039f99096bf164b71
MD5 4c036314f080c753345c8481caf9ae5f
SHA1 c90add2903b9de1bfac12a139e2551af8ec71745
SHA512 2c42b710436c2153a935fdbee7399177deca03c9c877cff99ef2dfa237fc7da5cc0dfbd93129122b268f8eda79f34e41ea5f9c901e5dee35861a2c9dce09bc38
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/eAe/z:vYer1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

SettingsCache.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
Size 670KB
SHA256 4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd
MD5 9eb5f69e443e7d835e78519e5f3b3ef4
SHA1 5ba40cd4a127359dbd006eb3b0f800809c138659
SHA512 b14fd14a1ac0aa59e0b648b64af0fa4848a4601124fe8b37d0c3f7e4066908237eb1c9d01a43aa45444db104c68380a60e1e1625d1f4eda5d501a3c33206cf4f
SSDEEP 6144:IWm9IqO3DNrR+0mAHv5vDn64xls+FpuMOCc5MpzgroTDL7keecgiTXK:l3rPn64NuMOCc5MpzgroTDL1K
MD5 SHA1 SHA512 SSDEEP

Submit Download

IDX_CONTENT_TASKBARHEADLINES.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
Size 183KB
SHA256 d72f3739d5e3be832569557e06dff172a85358c89f79a962e7c3199782f7d079
MD5 823676aa13680a6235df9f81d61be538
SHA1 f5612f7de2e42a8b94091d2119c5f2ddf0660a98
SHA512 b8060d3f54ec968f125d9b9cc48858eb938d0fc19168df5ed5c29a3d60d9f43c2adde7be0420a0daa38424ffecf814996f0b2154d2228b59b2976198887d4d7f
SSDEEP 1536:2WEEmYX6evMW9nb8jstPrVLOaiVN2a2LuntmI0A2ymBD8pJBKzu+sFwmBD8pnBiw:2kP5hHNrBcN2a2fkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 9KB
SHA256 0d4840bd2b3c541ba99951c1eba19163313f30edbf7f25f387cac2c24d900ee5
MD5 ed2adc32f662105a0db258f14ab8f5ba
SHA1 5241020ba4a9af62646400f4ab05cacb70a4e89c
SHA512 59f208eb34b94050f657dfe17b729466bb2984127e734be04acc6d515fb8fcc1131073ddba63508612118aee659beadb5348bf92d03b4e880bad6388d238552a
SSDEEP 192:WJAvpJmx97iyi7czkYJekoJkpCk5NDugAksz2ZUhmkDSRRPQReqjfQOVjeQ8RJo/:WJqpJpczkkeZJBAJ+pmcfQOVjeQ8RJo/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CortanaUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Size 10KB
SHA256 199d2045f81d7e84bac78a1ddc3bb9b56af8082555f4fb512022da655d33aacf
MD5 df8c2574235acb1711267d04359bc370
SHA1 e9e8db7b89e4904791d63d027693465dac923a21
SHA512 34cf34e78adc82331b88f8d5e8583ddd6b5bbe154995da7584475665999afd468bdcac9c0423591427c956cef010a1100ddefc57168cdbda73ae508d90a552be
SSDEEP 192:hJAvpJmx97iyi7czkYJekoJkpCk5NDugAksz2ZUhmkDSRRPQReqjfQOVjeQ8RJov:hJqpJpczkkeZJBAJ+pmcfQOVjeQ8RJov
MD5 SHA1 SHA512 SSDEEP

Submit Download

666.bat

Path C:\Users\Admin\Desktop\666.bat
Size 75B
SHA256 0bc40cfb15b5b174d9bcccf5b33a22e7dbdd87537b99983b455ccdf3946b5a1e
MD5 7bac7015899f13fbde968695969637e4
SHA1 e63f513b2a711dec86df4dc9c954b6a15448c97a
SHA512 fc237b682d038ba9145141bce203318335349a6bdc8b0f7efea1becd7c7addc40760bbc02918bf6fe855daf70e298ed522cddc90d0fcecdf4f0704761046d45f
MD5 SHA1 SHA512

Submit Download

666.bat

Path C:\Users\Admin\Desktop\666.bat
Size 27B
SHA256 64be6e3bd0b8d0b2c87b346d95de59948d2cac13a5a51772f7c7e4f9c99df2c4
MD5 3fa55b784f530eb357a4532b13bab9b0
SHA1 715c8318581a936aef4dd32e2d78fd68ad21fa3c
SHA512 d02fac5a1e291fd1058e545d7366225ed1195a3a042fad2aef4b6ec3476d2c14debacdc30729ce9a34f0bc0ec1a6332a30c62d73b9dc897fc9e915701d3aec03
MD5 SHA1 SHA512

Submit Download

memory/4456-233-0x00000226CC500000-0x00000226CC600000-memory.dmp

Download

memory/5096-229-0x00000215249A0000-0x00000215249A1000-memory.dmp

Download

memory/5096-208-0x0000021524960000-0x0000021524961000-memory.dmp

Download

memory/5096-230-0x00000215249F0000-0x00000215249F1000-memory.dmp

Download

memory/5096-231-0x00000215249F0000-0x00000215249F1000-memory.dmp

Download

memory/5096-228-0x0000021524990000-0x0000021524991000-memory.dmp

Download

memory/5096-219-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-227-0x0000021524990000-0x0000021524991000-memory.dmp

Download

memory/5096-218-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-217-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-224-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-225-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-215-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-216-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-213-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-214-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-220-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-210-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-212-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-211-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-209-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-207-0x0000021524960000-0x0000021524961000-memory.dmp

Download

memory/5096-205-0x0000021524950000-0x0000021524951000-memory.dmp

Download

memory/5096-206-0x0000021524960000-0x0000021524961000-memory.dmp

Download

memory/5096-203-0x0000021524950000-0x0000021524951000-memory.dmp

Download

memory/5096-201-0x0000021524810000-0x0000021524811000-memory.dmp

Download

memory/5096-166-0x000002151C540000-0x000002151C550000-memory.dmp

Download

memory/5096-182-0x000002151C640000-0x000002151C650000-memory.dmp

Download

memory/5096-226-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-223-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-222-0x0000021524980000-0x0000021524981000-memory.dmp

Download

memory/5096-221-0x0000021524980000-0x0000021524981000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads