Analysis

  • max time kernel
    26s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-01-2025 05:30

General

  • Target

    0accd01f0d991f0d00f34c239c2e74fa463911195b13c232099a77fbe43edd8aN.dll

  • Size

    816KB

  • MD5

    f91241e27f0a1689d976f33169b245d0

  • SHA1

    2af3e7341f0b6bb0272ceda410fcabdf39fa69b6

  • SHA256

    0accd01f0d991f0d00f34c239c2e74fa463911195b13c232099a77fbe43edd8a

  • SHA512

    3992cad45097a70abdab2b50947ec2c8ab8f4d7cd4307f5bb03c526875368ab62f2d128cb40ad9172ed101b3fc094c9ea5991ddc2867b46408448d90fbbf033e

  • SSDEEP

    6144:zh7RxJSC3VZLCEixjAoN6StM3LORFxz0Mn0G6oanXCW5DVQGVDmrvcJdR7OsDtom:zh9fKxjNoYxTw9XrRK0dBOJpy0RXR8p

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex family
  • Dridex Loader 'dmod' strings 2 IoCs

    Detects 'dmod' strings in Dridex loader.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0accd01f0d991f0d00f34c239c2e74fa463911195b13c232099a77fbe43edd8aN.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0accd01f0d991f0d00f34c239c2e74fa463911195b13c232099a77fbe43edd8aN.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5028
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4844
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4984
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:464
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4152
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4420
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1500
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2872
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4960
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1488
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1772
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4428
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:312
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2944
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3768
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4116
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2056
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2544
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5072
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:3684
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:1132
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4220
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2944
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:5064
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:5100
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2380
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2436
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:312
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:1536
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:2092
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1012
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3512
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4364
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:2304
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:2428
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4872
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:5000
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3876
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:212
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1480
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:1924
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4420
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:2020
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:4324
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3628
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:1732
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:316
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:2960
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3444
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3840
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3252
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2440
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4364
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3444
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2020
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3716
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4824
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2024
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:5032
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:2700
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:2220

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                        Filesize

                                                                                        471B

                                                                                        MD5

                                                                                        660332550820e3c62822b75bb4bbcb77

                                                                                        SHA1

                                                                                        dc6947395b036ffcf1a9f623ee56b3767bd27225

                                                                                        SHA256

                                                                                        2fda0d709d15286da3488750bce17859439a1274bc40008d9a0ee1bb9735dffd

                                                                                        SHA512

                                                                                        91872845ea6674e59b57ff7f01f3341909364e9c67b438d443f8efa574d505bbf83c2a5cc2b9e854cc3618211f6aefa2ca097154eb3217bc581d1a99f4a5fef8

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                        Filesize

                                                                                        412B

                                                                                        MD5

                                                                                        ea6fb2be8bd7486dfa8a07c573bb3d8a

                                                                                        SHA1

                                                                                        7cc5d80db80bc22b39fc3cc7925be13c9e4142b7

                                                                                        SHA256

                                                                                        6a921367763d1ca17fae6b6cfc8a7db03d2fe5f85c226170fd9766ff7fe8a845

                                                                                        SHA512

                                                                                        8cbc13e5812515acb75e5937f4758c6f233bf1b455c0a888d93b8a2ce1c5f2f8f02502e61d1cd5ce298d60cfe414ae0c0a8d13725342f4fd8f7faaed40fb9f3a

                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        00dec89ecf9868de3598d8540d276912

                                                                                        SHA1

                                                                                        5aa4ffb4a76517103fb8a597db83ca340121bf83

                                                                                        SHA256

                                                                                        6bd1309dd01f7a142ba2cda072cda263c92ecb7167d2c562abd06af5c4d7ca85

                                                                                        SHA512

                                                                                        1700726b8b43543e86799b0675d9784901ce6202a5489f776935c2ca23bd6e0b058d506c795755df1e0f4810ee361d99b04b8d7e4590d5eaacb40c1bc923af80

                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2CFNWDLC\microsoft.windows[1].xml

                                                                                        Filesize

                                                                                        97B

                                                                                        MD5

                                                                                        539db492f33fccee9be530dd0bf34a46

                                                                                        SHA1

                                                                                        650b2a3583d6c9499b4ed73e9a5dca37f342a50e

                                                                                        SHA256

                                                                                        f6d425aad05b46e77b53e5737c85f4ceab6531e773ea87eb985754be5ec19999

                                                                                        SHA512

                                                                                        9328f2fa286b4a9ca6ae57ddd9fca0b1140e5f68a5e143fd8ae6ea212a1af5d7b6b2289c324fa9480ca8d2e6d3b0cf7115611a56a3a161c5ad2f988f6ae62a0a

                                                                                      • memory/212-738-0x0000020F8DB60000-0x0000020F8DC60000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/212-773-0x0000021790090000-0x00000217900B0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/212-756-0x000002178FC80000-0x000002178FCA0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/212-742-0x000002178FCC0000-0x000002178FCE0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/316-979-0x0000000003610000-0x0000000003611000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1536-514-0x000001FE87530000-0x000001FE87550000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/1536-534-0x000001FE87940000-0x000001FE87960000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/1536-502-0x000001FE87570000-0x000001FE87590000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/1536-498-0x000001FE85520000-0x000001FE85620000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/1536-497-0x000001FE85520000-0x000001FE85620000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/2056-254-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2304-638-0x000001D711900000-0x000001D711920000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/2304-650-0x000001D711D00000-0x000001D711D20000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/2304-620-0x000001D710800000-0x000001D710900000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/2304-625-0x000001D711940000-0x000001D711960000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/2424-14-0x00000000034A0000-0x00000000034A1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2436-495-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2944-138-0x0000020ADEB00000-0x0000020ADEC00000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/2944-147-0x0000020ADFE00000-0x0000020ADFE20000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/2944-142-0x0000020ADFE40000-0x0000020ADFE60000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/2944-157-0x0000020AE0200000-0x0000020AE0220000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/3444-981-0x00000153F8650000-0x00000153F8750000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/3444-982-0x00000153F8650000-0x00000153F8750000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/3512-618-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4220-373-0x0000000003630000-0x0000000003631000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4324-886-0x0000024627640000-0x0000024627660000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4324-859-0x0000024626120000-0x0000024626220000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/4324-860-0x0000024626120000-0x0000024626220000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/4324-875-0x0000024627230000-0x0000024627250000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4324-863-0x0000024627270000-0x0000024627290000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4324-858-0x0000024626120000-0x0000024626220000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/4420-857-0x00000000044A0000-0x00000000044A1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4428-135-0x0000000003340000-0x0000000003341000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/4960-52-0x000002013F260000-0x000002013F280000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4960-30-0x000002013EC50000-0x000002013EC70000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4960-21-0x000002013EC90000-0x000002013ECB0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4960-16-0x000002013DF00000-0x000002013E000000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/5000-734-0x0000000004070000-0x0000000004071000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/5028-0-0x0000000000BF0000-0x0000000000BF6000-memory.dmp

                                                                                        Filesize

                                                                                        24KB

                                                                                      • memory/5028-11-0x0000000000BF0000-0x0000000000BF6000-memory.dmp

                                                                                        Filesize

                                                                                        24KB

                                                                                      • memory/5028-2-0x0000000075650000-0x000000007571C000-memory.dmp

                                                                                        Filesize

                                                                                        816KB

                                                                                      • memory/5028-10-0x0000000075650000-0x000000007571C000-memory.dmp

                                                                                        Filesize

                                                                                        816KB

                                                                                      • memory/5064-379-0x000002A3DECC0000-0x000002A3DECE0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/5064-411-0x000002A3DF2A0000-0x000002A3DF2C0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/5064-389-0x000002A3DEC80000-0x000002A3DECA0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/5064-375-0x000002A3DDD60000-0x000002A3DDE60000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/5064-374-0x000002A3DDD60000-0x000002A3DDE60000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/5072-271-0x000001F2323D0000-0x000001F2323F0000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/5072-285-0x000001F2329E0000-0x000001F232A00000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/5072-260-0x000001F232620000-0x000001F232640000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/5072-255-0x000001F231300000-0x000001F231400000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB