Overview

overview

8

Static

static

3

ep_setup.exe

windows7-x64

3

ep_setup.exe

windows10-2004-x64

8

Resubmissions

26/07/2024, 17:50

240726-wevbxaxgnh8

26/07/2024, 17:44

240726-wa8zhatern8

Analysis

  • max time kernel
    1049s
  • max time network
    1052s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ep_setup.exe
  • Size 2.5MB
  • Sample240726-wevbxaxgnh
  • SHA256 6942de4845ca2bff1665cc1a0fb1a46eaa36404b7e4436dee9552ea5f2216f92
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
steamdiscoveryevasionexecutionpersistencephishingprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 47 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Detected potential entity reuse from brand steam.
    phishingsteam
  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ep_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:436
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:3480
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:1996
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
      2⤵
      • Loads dropped DLL
      PID:4396
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:3952
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Loads dropped DLL
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4900
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:5020
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3720
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4392
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3588
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3484
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1448
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4380
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3476
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies registry class
    PID:4684
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2704
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:3848
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4040
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3844
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:3640
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:3680
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3784
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4608
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa53f546f8,0x7ffa53f54708,0x7ffa53f54718
        3⤵
          PID:1860
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
          3⤵
            PID:3284
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:216
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
            3⤵
              PID:908
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
              3⤵
                PID:4872
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                3⤵
                  PID:3400
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
                  3⤵
                    PID:5616
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                    3⤵
                      PID:5624
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
                      3⤵
                        PID:3476
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5328
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
                        3⤵
                          PID:2372
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                          3⤵
                            PID:4876
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5020 /prefetch:8
                            3⤵
                              PID:4772
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5736 /prefetch:8
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5376
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                              3⤵
                                PID:1716
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
                                3⤵
                                  PID:6108
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
                                  3⤵
                                    PID:5304
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                    3⤵
                                      PID:4608
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                      3⤵
                                        PID:5312
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                                        3⤵
                                          PID:5520
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
                                          3⤵
                                            PID:5264
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
                                            3⤵
                                              PID:4856
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
                                              3⤵
                                                PID:3516
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
                                                3⤵
                                                  PID:5788
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
                                                  3⤵
                                                    PID:4048
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                                                    3⤵
                                                      PID:5436
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6120 /prefetch:2
                                                      3⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5376
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
                                                      3⤵
                                                        PID:5372
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
                                                        3⤵
                                                          PID:5352
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
                                                          3⤵
                                                            PID:4036
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
                                                            3⤵
                                                              PID:5208
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
                                                              3⤵
                                                                PID:2896
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
                                                                3⤵
                                                                  PID:5864
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
                                                                  3⤵
                                                                    PID:5824
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                                                                    3⤵
                                                                      PID:396
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
                                                                      3⤵
                                                                        PID:4900
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                                                                        3⤵
                                                                          PID:2152
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                                                                          3⤵
                                                                            PID:3676
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
                                                                            3⤵
                                                                              PID:1084
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1160 /prefetch:1
                                                                              3⤵
                                                                                PID:4212
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
                                                                                3⤵
                                                                                  PID:5128
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1
                                                                                  3⤵
                                                                                    PID:2660
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
                                                                                    3⤵
                                                                                      PID:4160
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8164 /prefetch:8
                                                                                      3⤵
                                                                                        PID:212
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
                                                                                        3⤵
                                                                                          PID:5280
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8172 /prefetch:1
                                                                                          3⤵
                                                                                            PID:5776
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                                                                                            3⤵
                                                                                              PID:1628
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4976 /prefetch:8
                                                                                              3⤵
                                                                                                PID:4136
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:1
                                                                                                3⤵
                                                                                                  PID:3184
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
                                                                                                  3⤵
                                                                                                    PID:4252
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
                                                                                                    3⤵
                                                                                                      PID:3404
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7546683185295831744,10200129869929913145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
                                                                                                      3⤵
                                                                                                        PID:4584
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                    • Loads dropped DLL
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4524
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                    • Modifies Internet Explorer settings
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4048
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:3452
                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:5228
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Loads dropped DLL
                                                                                                        • Enumerates connected drives
                                                                                                        PID:5512
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5996
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Loads dropped DLL
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5308
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2312
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                        • Modifies Internet Explorer settings
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:3656
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Loads dropped DLL
                                                                                                        • Enumerates connected drives
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:6008
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5148
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                        • Modifies Internet Explorer settings
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5640
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Loads dropped DLL
                                                                                                        • Enumerates connected drives
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5656
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5348
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                        • Modifies Internet Explorer settings
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5628
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Loads dropped DLL
                                                                                                        • Enumerates connected drives
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5444
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5776
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                        • Modifies Internet Explorer settings
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:3712
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Loads dropped DLL
                                                                                                        • Enumerates connected drives
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1604
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1472
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Loads dropped DLL
                                                                                                        • Enumerates connected drives
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:5500
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:864
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                        • Modifies Internet Explorer settings
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:644
                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x4a4 0x41c
                                                                                                        1⤵
                                                                                                          PID:6140
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:4168
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:2624
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:5676
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:2860
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:4984
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:612
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:5624
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:5536
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:6132
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies registry class
                                                                                                          PID:5824
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:1312
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          PID:5248
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          PID:5500
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:4700
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          PID:5428
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          PID:4056
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:3812
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          PID:4668
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          PID:2820
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:4608
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          PID:5520
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          PID:3868
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          • Modifies registry class
                                                                                                          PID:4484
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          PID:4872
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:2396
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          PID:3380
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies registry class
                                                                                                          PID:5140
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:6008
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          PID:6004
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          PID:2812
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:6072
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          PID:4812
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Modifies registry class
                                                                                                          PID:5988
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:3868
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          PID:6108
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Modifies registry class
                                                                                                          PID:5284
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:5976
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          PID:5820
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                          • Loads dropped DLL
                                                                                                          • Enumerates connected drives
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          PID:1916
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:2980
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:2988
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                            • Loads dropped DLL
                                                                                                            • Enumerates connected drives
                                                                                                            • Modifies registry class
                                                                                                            PID:5032
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                            • Loads dropped DLL
                                                                                                            • Enumerates connected drives
                                                                                                            • Checks SCSI registry key(s)
                                                                                                            PID:5796
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                            • Loads dropped DLL
                                                                                                            • Enumerates connected drives
                                                                                                            PID:5296
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:2408
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                                              • Enumerates connected drives
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              PID:1868
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:3656
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                • Modifies Internet Explorer settings
                                                                                                                PID:4700
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                • Enumerates connected drives
                                                                                                                • Checks SCSI registry key(s)
                                                                                                                PID:4256
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:3116
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                  • Modifies registry class
                                                                                                                  PID:5644
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                  • Enumerates connected drives
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Modifies registry class
                                                                                                                  PID:5768
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3620
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                    • Modifies registry class
                                                                                                                    PID:6044
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                                                    • Modifies registry class
                                                                                                                    PID:3476
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:436
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                      PID:4940
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                                      • Enumerates connected drives
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Modifies registry class
                                                                                                                      PID:2980
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:3996
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                        PID:6088
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                                        • Enumerates connected drives
                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                        PID:436
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:6020
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          PID:5440
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                          PID:5156
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:5336
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                            • Modifies registry class
                                                                                                                            PID:4892
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                            • Enumerates connected drives
                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                            • Modifies registry class
                                                                                                                            PID:5928
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:5200
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                              PID:6108
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                                                              • Enumerates connected drives
                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                              PID:5472
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:5460
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                PID:3780
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                PID:5500
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:5640
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:5848
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                  • Enumerates connected drives
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:4348
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:864
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:2036
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                    PID:5180
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:2144
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                      1⤵
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:5776
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                      • Enumerates connected drives
                                                                                                                                      PID:5432
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:2916
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                        PID:2660
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                        • Enumerates connected drives
                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                        PID:448
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:5040
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                          PID:436
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                          • Modifies registry class
                                                                                                                                          PID:1088
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:4692
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                            PID:3952

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Reconnaissance

                                                                                                                                                Resource Development

                                                                                                                                                Initial Access

                                                                                                                                                Execution

                                                                                                                                                System Services

                                                                                                                                                1
                                                                                                                                                T1569

                                                                                                                                                Service Execution

                                                                                                                                                1
                                                                                                                                                T1569.002

                                                                                                                                                Persistence

                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                1
                                                                                                                                                T1547

                                                                                                                                                Active Setup

                                                                                                                                                1
                                                                                                                                                T1547.014

                                                                                                                                                Create or Modify System Process

                                                                                                                                                1
                                                                                                                                                T1543

                                                                                                                                                Windows Service

                                                                                                                                                1
                                                                                                                                                T1543.003

                                                                                                                                                Event Triggered Execution

                                                                                                                                                1
                                                                                                                                                T1546

                                                                                                                                                Component Object Model Hijacking

                                                                                                                                                1
                                                                                                                                                T1546.015

                                                                                                                                                Privilege Escalation

                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                1
                                                                                                                                                T1547

                                                                                                                                                Active Setup

                                                                                                                                                1
                                                                                                                                                T1547.014

                                                                                                                                                Create or Modify System Process

                                                                                                                                                1
                                                                                                                                                T1543

                                                                                                                                                Windows Service

                                                                                                                                                1
                                                                                                                                                T1543.003

                                                                                                                                                Event Triggered Execution

                                                                                                                                                1
                                                                                                                                                T1546

                                                                                                                                                Component Object Model Hijacking

                                                                                                                                                1
                                                                                                                                                T1546.015

                                                                                                                                                Defense Evasion

                                                                                                                                                Impair Defenses

                                                                                                                                                1
                                                                                                                                                T1562

                                                                                                                                                Modify Registry

                                                                                                                                                2
                                                                                                                                                T1112

                                                                                                                                                Credential Access

                                                                                                                                                Discovery

                                                                                                                                                Browser Information Discovery

                                                                                                                                                1
                                                                                                                                                T1217

                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                2
                                                                                                                                                T1120

                                                                                                                                                Query Registry

                                                                                                                                                6
                                                                                                                                                T1012

                                                                                                                                                System Information Discovery

                                                                                                                                                5
                                                                                                                                                T1082

                                                                                                                                                Lateral Movement

                                                                                                                                                Collection

                                                                                                                                                Command and Control

                                                                                                                                                Exfiltration

                                                                                                                                                Impact

                                                                                                                                                Service Stop

                                                                                                                                                1
                                                                                                                                                T1489

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                WebView2Loader.dll
                                                                                                                                                • Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
                                                                                                                                                • Size 136KB
                                                                                                                                                • SHA256 ad8bb426a8e438493db4d703242f373d9cb36d8c13e88b6647cd083716e09bef
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                ep_gui.dll
                                                                                                                                                • Path C:\Program Files\ExplorerPatcher\ep_gui.dll
                                                                                                                                                • Size 712KB
                                                                                                                                                • SHA256 15fca06b049e6fd7a7250eb0ee2be390a63ce30193021a9e7165ecaaa1e71ad6
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                ep_weather_host.dll
                                                                                                                                                • Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
                                                                                                                                                • Size 243KB
                                                                                                                                                • SHA256 3413f0a0058f9f2fcb5910ad4fd2376c4f2aee3680d73a93cd977ff9059d396d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                ep_weather_host_stub.dll
                                                                                                                                                • Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
                                                                                                                                                • Size 114KB
                                                                                                                                                • SHA256 65d3413d21544a7e6f6ef98bc13bf81a0111a386ea54280109defa8db97d82e7
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                                • Size 471B
                                                                                                                                                • SHA256 f262436c723d73cf516b6f95cb59e289841e9c8a4141b098d8a3a92bd27ca0d1
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                                • Size 420B
                                                                                                                                                • SHA256 55fcbac8e5a1630b079601d471c19a3cc473411013a0b14801c4bbecae413070
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 152B
                                                                                                                                                • SHA256 fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 152B
                                                                                                                                                • SHA256 71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                f_000002
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                                                • Size 64KB
                                                                                                                                                • SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000003
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                                                                • Size 67KB
                                                                                                                                                • SHA256 a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000004
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                                                • Size 41KB
                                                                                                                                                • SHA256 8b712d8018f2c97283d0264ace2a982a627e050d0b428597a6d31abf78db7d79
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000005
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                                                                • Size 63KB
                                                                                                                                                • SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000006
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                                • Size 19KB
                                                                                                                                                • SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000007
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                                                                • Size 88KB
                                                                                                                                                • SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000008
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
                                                                                                                                                • Size 1.2MB
                                                                                                                                                • SHA256 088c9b305f64ae73af52bec73101e6bb1914b8e0931cd1d3aee8944a3abd18bf
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_00000a
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
                                                                                                                                                • Size 43KB
                                                                                                                                                • SHA256 ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_00000b
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
                                                                                                                                                • Size 73KB
                                                                                                                                                • SHA256 e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_00001a
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
                                                                                                                                                • Size 20KB
                                                                                                                                                • SHA256 b6e402069decead39d4fc8b1be4458df3dad2e85d34d0d0b421fc870099e2cda
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000024
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024
                                                                                                                                                • Size 53KB
                                                                                                                                                • SHA256 f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000025
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025
                                                                                                                                                • Size 40KB
                                                                                                                                                • SHA256 992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000029
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029
                                                                                                                                                • Size 18KB
                                                                                                                                                • SHA256 de0b58b07b227e1cbe939e49f7dbfa0bb660c91b46c7d04568b55906337ea211
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_00002c
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c
                                                                                                                                                • Size 17KB
                                                                                                                                                • SHA256 4556beb0349bcad0d28725d4849283e8417e0bbea5b94e256d115dea24fe33c7
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000031
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031
                                                                                                                                                • Size 62KB
                                                                                                                                                • SHA256 87938e4f4d76399f0f7bd19469916684fc6171ce362f657c7f6e5cd079091ca8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000045
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045
                                                                                                                                                • Size 19KB
                                                                                                                                                • SHA256 b82fa6bdcf4e948daa03b80d31dacaa7d1294df4ffe0d3ddaf55d6259d1576a2
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000055
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055
                                                                                                                                                • Size 19KB
                                                                                                                                                • SHA256 bf3c6b9b7e9cda978772d28554d10cf226ccb4292e7ecc4006a5a8fb553ccffa
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000056
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056
                                                                                                                                                • Size 38KB
                                                                                                                                                • SHA256 283a5b9c3c3ecb9677ee5e87a5864472b458d6cc8a9ef84c551ee76223be749e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                f_000057
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000057
                                                                                                                                                • Size 53KB
                                                                                                                                                • SHA256 5a5018919a3db5d96e64d572ae1bc6da7139ca0b51eb9436011a4688c96661a2
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                06450eb6a7b09545_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 9ea2449eb11be34906c8f6e0ac8bffb50c93c3513e882764ae180e6c240b0357
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                1927a26afb9a8b4a_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1927a26afb9a8b4a_0
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 378920ef3f85d02aa0f0146d7b41491e9200fc1f57a12b6783ba35a6b7cbc8e2
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                25c90b4fb1c6ef85_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 0000db1356ba4fd6f4d8037c6f44c25311f1ed843b0a2c9efb8190e0f3166a57
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                3f02c4494b1a18ff_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f02c4494b1a18ff_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 dde32bcc701ccb88589048be06986a69a672225d59f01a20c0847ce5c7370de4
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                45a16ff6d0d9ab5f_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 8ecf8372d59283e38bbec26c34c29cdf0f569a08ee597519bf096dc89d540901
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                4fea9b1c58473689_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4fea9b1c58473689_0
                                                                                                                                                • Size 100KB
                                                                                                                                                • SHA256 af2ecbf33d74abe4315e3d0c88716ec047099282fc19ae5d7de150b0a787be89
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                54621936eea23565_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\54621936eea23565_0
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 7cfbe5775e2d3112e85a801801812b608eeb3265ca9d50e1102eccb039657a6f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                6d3b0ad57bdf7db9_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 46d30ebb75d58fc50ff065057d1a2a89c2c7163b6680680442923aa9bcee14b2
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                718cc3a9e092869d_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\718cc3a9e092869d_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 6c3167db456c73a12138caafc93d35de83c044e319230ba0cdec1672721f92f7
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                7a66a1246c4f29f4_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 0a87f25017e981d50b08fb37d0050739c6812d58f09882c43282dc5e4b7f8f75
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                7e23bcf4dbf5c221_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e23bcf4dbf5c221_0
                                                                                                                                                • Size 14KB
                                                                                                                                                • SHA256 9376684dab3ba8f1215bc41585a9ea77d330c2fcde50fc0b95460c12f5a18467
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                8ee73a31bd0cce7d_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ee73a31bd0cce7d_0
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 7289dca6e3e8cbd046553757d905a22e45146a94b3e1238ade65568b57921b7d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                9aee5cd509922cea_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9aee5cd509922cea_0
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 b2294798926f5d88707a0aaa5290dad9bb9f6488e955258cfcf27decb222fbb1
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                9b514ce627124747_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9b514ce627124747_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 211fb108ceae440a34c1f5a69098e240abc81d6c3a99fe7c00f7b0c102986221
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                a09f6271ad0c4092_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0
                                                                                                                                                • Size 47KB
                                                                                                                                                • SHA256 af8614dfb3a34c2269b6adc7fd798ffdc875104349d217211d02231b03e83c4b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                a44b8249ebfdb225_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a44b8249ebfdb225_0
                                                                                                                                                • Size 303B
                                                                                                                                                • SHA256 168e4c6d407ae920f20e8cd890ee0a20147f2c046ae7f90953e27b5fd67fa9b6
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                a6537dab24e365f9_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6537dab24e365f9_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 58616c25ad30835a3b97ed729774a74c000addcd3d0e0273e5279db4a05f8685
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                af2cfcaf6d9b18bc_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 4c834c9cae54061a60ac6172dacad69c9fb0552be4916eeb9013b1d1d4b84c5b
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                b2a2ea4987d45e0f_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b2a2ea4987d45e0f_0
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 330bccd49ed9f763fa998531aaff93554e582c75a6abd16b085e158ed6ad219f
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                d00019f29c31fea5_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d00019f29c31fea5_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 6731651ae5576919f299ac0408a715ddd3b4874b8a596a37b3f309d367006406
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                daea348421cbc209_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 ba9451ad93b85b30ce262a3346570b04f0cf86ee6eecbfbe065a67d9f4cc172e
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                e55f0a6d1b533c66_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 b17b1dd676de4ed3ef470360441441e139908445071f63f5834c6f1688fd9703
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                e7b946bebf228627_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e7b946bebf228627_0
                                                                                                                                                • Size 54KB
                                                                                                                                                • SHA256 0272ce9f9f19517b7b989a482342ad679a36e0656536639e609dd459dea1cb31
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                fec794709b15fe04_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fec794709b15fe04_0
                                                                                                                                                • Size 22KB
                                                                                                                                                • SHA256 c088bce3ab5b462f33fe4acbfb87495b5503f751bc82b295766890317b1a5227
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 a58d2bdedb7dd2559f19ed9053b6e97e73d457add95e53781fc394b5baf0dc4d
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 e79c1debf25249aab2c54abcb00834c9f6bca5907daab4897f827af70025c6be
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 95f4073cc32775510ee5067e34d88f791d4a8c341e4b64cecbacb89357373ab0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 a8fe87005162d1117120082200c4c3214d568f9894e2300db0d9c9545dd8e60b
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 d39b5791f4042d0d89d4578dffac76815ac306fafdc297f23bd8c97b30b2d5e6
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 b7d2ea0965ddfd936d5e4f52878efedd17500867f8bf5d9a4733681f535e7663
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 c25840f77b0cab3734af25aa580f20d78900fe11458227a779a428a3d913da56
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 119ef2eeef8c614b2de3ee6807b239852f0a884a6e3049d12bf6040dcc8ad6f3
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 aa0bd30825a3e1b813c70bd2c37aa417542485205bcd98d1154a714a6a8c38a9
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 1acd4a2d48a6f8af1478cf57f45e6d82832aaa82b4941e8824f6b86a270d5f98
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 6239194b615cf7a87b99f51f4bb5ffaaf6665be7cba5b77d04e7ec1803e20118
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 d2a66845549edbd46e2f320da2d49bbfc1afeddc26933cc6b0b5c93face03e28
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 988cf043b2bc0650c556e0338e94dfff99b447b797df3d5093a697447bda3a45
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 8105d77edc8786f9e5e1a15776b324ebd35bedf9e72cc94002342af5261e3d53
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 0d3f2d573541f42ca5cf383e51e31345effbb6ae4eb38171e3eb44939947e556
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 f818470fe2baa35cfee56ea87764ef5bfd291c583227824a611ac8ac7dcd52c8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 e8c6d9cd446b404ef66cb5c20c2984f2ce7645881a8f43ac2c6d8a542195d226
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 5329b9aa916598b3074b846985bdd9e4f1d5a7507d0679289fb53f4138d76845
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 18cd8a6a526126070ee116f957f0e4a96ac49a5f29717b6dfa37102d43574454
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 73bd6c3c12f626db0d6d48ac0f56fdff7c016ccff65bb67d82e6cb35e3a78f39
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 d912c4a0417df05996c8437b27ea7dde13de63c8182d1a79dca16a7bbe46bb9d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 9a37cdda35755b6cbbf345e8abd9bd670dae0e82ed94464a2e7dbfd13701c7a4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 35acce8207c4ded4c4165e5c7709626a879dab3973cab2b2b880894b083a9aec
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 dc814368ad54478336fd1fd78176218f55cd06ccbb7bef139af7b60140f778d5
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 9c6c986674c54b6336ed2599c7443885e3befe1cf59c9e03ce2823aa96a43667
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 bad26d06311ea3f959eb6402854e0272ad68c9664b00b0f6abf690c1303c1b9e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 e67ed87211d48c597e40fac66d1eb1c8db681c154798337af55cc289f1d24266
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 a72ef6b3bc2b631415d398671f9d50ec592b4dfb8cd72353cd57536a5ed7e5c7
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 5f549a8d14f7027c21f8f8ad91171c3903f3af068a424a7a556cc8b84d17bb2a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 869B
                                                                                                                                                • SHA256 732aef5c0cecd36b32b82730109a130ffa4a8eb0de0d3da18798b6943d76e964
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 b6d64601c1a2607a57dec3109b91f65a6362e2e3db7e3714c383792730007dd2
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 5426df04bb50bdc17fa341455c6d29fad67493d1fdc612495918fd0c5b645551
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 8009b2200c4c58c3c2cc2c4484c55cf4486953a180a21632c6841b3e1b35b66e
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 869B
                                                                                                                                                • SHA256 cc740be6e5a8b1582c8cfa7839e32716acbe96a4ed8b109ca4baf72a13d90168
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 aa22768e6806b6f0c147a07238cb10aa5234a77919d8db1880348e1a4f24a02d
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 89a7b86314876090a143518d92fc9f33ecee59e9ef27b4df9304a8deeb96f889
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 869B
                                                                                                                                                • SHA256 65b132a2cd9fe72916c496804780b605d0255869ea80791f39a0a4b0c45d1fb6
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 68da4a5abc51e6bdc5cee7d84fcfbeb0b9c9717469cef8bf3bdcf0f8eb067921
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 a1553a5a85dc07a4e72bab1697ecb22eecfb68c6701a04265f1545ea40ddf160
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 88d3b99073806694b4f162ac63aefb72d699c41c8f6e3e975d86dc7f7c9299c8
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 a0a330f38a684c7599506c250a0e74229a8f7b17482455de1ee689d995117bd9
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                • Size 869B
                                                                                                                                                • SHA256 d582ee0417fb6094f40c93d4dcc0a27ca0eaca16d9fcfa934aea88aeac0ed938
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity~RFe591217.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591217.TMP
                                                                                                                                                • Size 701B
                                                                                                                                                • SHA256 b8ba70fddec62cdf19b9b6670d083058c19b079d7e39439b9da12065c63a90a0
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                CURRENT
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                • Size 16B
                                                                                                                                                • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                e95c3340-797e-463f-8a6d-aeed4f9c5570.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e95c3340-797e-463f-8a6d-aeed4f9c5570.tmp
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 baef87c4850865fb986abd00afb1e464ec74ed6efbdd41e096b69176cd09e19a
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 83e094564cd2adf525781cd5538969558aa3f4d16dc0c99d88c1121acb569a2a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 12KB
                                                                                                                                                • SHA256 36b70343c8ccc275a9923aaa95a077f5a80638fab361aa118412ca68d284cb69
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 eb615c6bd07acab7460878c499add1868618e890d1a392400a5226ed8d07280f
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Microsoft_Windows_ControlPanel
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
                                                                                                                                                • Size 36KB
                                                                                                                                                • SHA256 1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                https___docs_oracle_com_javase_8_docs
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___docs_oracle_com_javase_8_docs
                                                                                                                                                • Size 36KB
                                                                                                                                                • SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                {6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
                                                                                                                                                • Size 36KB
                                                                                                                                                • SHA256 8cc15be591c4f70f964d3554be30283f925747d09eb71692bf40b8125e2bb68a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                0.0.filtertrie.intermediate.txt
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9bd7f81c-cf88-4e0d-966f-245b457cb146}\0.0.filtertrie.intermediate.txt
                                                                                                                                                • Size 28KB
                                                                                                                                                • SHA256 8ce500c65902092a179f1b0016fb49ece5a10b440cac6709e0af76b97c5ffc2d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                0.1.filtertrie.intermediate.txt
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9bd7f81c-cf88-4e0d-966f-245b457cb146}\0.1.filtertrie.intermediate.txt
                                                                                                                                                • Size 5B
                                                                                                                                                • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                0.2.filtertrie.intermediate.txt
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9bd7f81c-cf88-4e0d-966f-245b457cb146}\0.2.filtertrie.intermediate.txt
                                                                                                                                                • Size 5B
                                                                                                                                                • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Apps.index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9bd7f81c-cf88-4e0d-966f-245b457cb146}\Apps.index
                                                                                                                                                • Size 1.0MB
                                                                                                                                                • SHA256 694b1ee982154c5317a6780df03e1577a8868171b58f8848d2477e93dd956123
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                AppCache133664900140883829.txt.~tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664900140883829.txt.~tmp
                                                                                                                                                • Size 75KB
                                                                                                                                                • SHA256 d7136622780a890d38c7362a6c5276d77c3ee39ee3695dc44448ef1016075c50
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                AppCache133664900630669112.txt.~tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664900630669112.txt.~tmp
                                                                                                                                                • Size 76KB
                                                                                                                                                • SHA256 eab0c6246265a9ca052095c33ce2eebe6514f635cea7426cebd9f25555e2932f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                microsoft.windows[1].xml
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IPWDBVC8\microsoft.windows[1].xml
                                                                                                                                                • Size 97B
                                                                                                                                                • SHA256 eb95953230a3e16e917b8d37b9ec78ff50b28b0467cbff3774aa8b96cb13aa60
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                microsoft.windows[1].xml
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IPWDBVC8\microsoft.windows[1].xml
                                                                                                                                                • Size 191B
                                                                                                                                                • SHA256 599ffbed97e93ca890f2cde73dd5a9904ef3698a37f818ff15afc2ce16ae9c1e
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                StartUI.pdb
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
                                                                                                                                                • Size 35.4MB
                                                                                                                                                • SHA256 37daf447f92f6d910d69fd8b9d549aa3d098dc38b374a63e83b15ca16f26504c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                twinui.pcshell.pdb
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
                                                                                                                                                • Size 444KB
                                                                                                                                                • SHA256 9c0937dfb6e5edda254ec4af5e2d6bd1d117df7fa39951ac558d01d5901dd406
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                twinui.pcshell.pdb
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
                                                                                                                                                • Size 17.9MB
                                                                                                                                                • SHA256 589c2ff9e4ac0465a8b682d6fb988c81b4e91af9f760d174811315681d94b954
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                twinui.pcshell.pdb
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
                                                                                                                                                • Size 236KB
                                                                                                                                                • SHA256 641de24eaaca414af9bb6f03dc7ef1c1fd68ece1cbb49427712b3e18811fd4cb
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                default.dic
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                • Size 2B
                                                                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                • Size 14KB
                                                                                                                                                • SHA256 fecf04ffc7e59f6206519e63fd003040c92e4dad7e6da3e66bfc3903de6f1dda
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                • Size 12KB
                                                                                                                                                • SHA256 43c3d473f4a74e98bae03eb0aae3954ae4511f4ba9ab663e4548a56eb24d0025
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                dxgi.dll
                                                                                                                                                • Path C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
                                                                                                                                                • Size 685KB
                                                                                                                                                • SHA256 9ee551b2cc3f8e634441254deec3280bb84f10b5a2b8b70b362055c2f224c1e9
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                dxgi.dll
                                                                                                                                                • Path C:\Windows\dxgi.dll
                                                                                                                                                • Size 685KB
                                                                                                                                                • SHA256 e5d4128119ecdbfe3c59e19da569ea672d25087b1c18b2255a385f7558c69eb3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                memory/3720-92-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-81-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-69-0x00007FFA73840000-0x00007FFA73F7F000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-70-0x00007FFA5E560000-0x00007FFA5E780000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-71-0x00007FFA5E560000-0x00007FFA5E780000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-94-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-68-0x00007FFA73840000-0x00007FFA73F7F000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-93-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-91-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-90-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-73-0x00007FFA5E560000-0x00007FFA5E780000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-89-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-88-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-74-0x00007FFA5E560000-0x00007FFA5E780000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-86-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-75-0x00007FFA5E560000-0x00007FFA5E780000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-85-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-83-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-82-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-80-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-76-0x00007FFA735D0000-0x00007FFA73771000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-79-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-77-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-87-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-78-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-72-0x00007FFA5E560000-0x00007FFA5E780000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3720-84-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-59-0x0000000002BA0000-0x0000000002C49000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-21-0x00007FFA73840000-0x00007FFA73F7F000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-24-0x00007FFA5E550000-0x00007FFA5E770000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-25-0x00007FFA5E550000-0x00007FFA5E770000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-32-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-38-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-37-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-33-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-26-0x00007FFA5E550000-0x00007FFA5E770000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-31-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-58-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-27-0x00007FFA5E550000-0x00007FFA5E770000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-30-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-41-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-47-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-28-0x00007FFA735D0000-0x00007FFA73771000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-49-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-23-0x00007FFA5E550000-0x00007FFA5E770000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-34-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-48-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-20-0x00007FFA73840000-0x00007FFA73F7F000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-42-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-29-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-22-0x00007FFA5E550000-0x00007FFA5E770000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-46-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-45-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-44-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-43-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-40-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-50-0x00007FFA5DE20000-0x00007FFA5E446000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-52-0x00007FFA5D620000-0x00007FFA5DC13000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-53-0x00007FFA6B9F0000-0x00007FFA6BA36000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-39-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-35-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-57-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4900-36-0x00007FF7A1C50000-0x00007FF7A20ED000-memory.dmp
                                                                                                                                                Download