Overview

overview

10

Static

static

3

86d411672f...46.dll

windows7-x64

10

86d411672f...46.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    32s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-02-2025 01:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    86d411672feb96c86028bc1b92b24a82f466142eb69114a678239e03c1035146.dll

  • Size

    844KB

  • MD5

    3e9263f8e367d1ca5323180b4f97062c

  • SHA1

    e1994d805eb16ca16a5a88a96702b15822bdc1b2

  • SHA256

    86d411672feb96c86028bc1b92b24a82f466142eb69114a678239e03c1035146

  • SHA512

    9c069af43f7ea6412bf6eeddb063a090e19de725d577bc41891495845984262c9ebdb698727afcb82327f60bed62a7019dd55a9139390d6635c522109e14bd16

  • SSDEEP

    12288:mh9fKxjNoYxTw9XrRK0dBOJpy0RXR8p2N1:m74xw9ddURN6p2N

Score
10/10
dridexbotnetdiscoveryloaderpersistence

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex family
    dridex
  • Dridex Loader 'dmod' strings 2 IoCs

    Detects 'dmod' strings in Dridex loader.

    botnetloader
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\86d411672feb96c86028bc1b92b24a82f466142eb69114a678239e03c1035146.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\86d411672feb96c86028bc1b92b24a82f466142eb69114a678239e03c1035146.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2724
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4492
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2980
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4036
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2068
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3784
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4576
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3320
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4476
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2244
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3856
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:668
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4764
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4760
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:112
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2336
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3720
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2260
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1536
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:916
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Modifies registry class
    PID:3836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4324
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4180
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:3940
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:1244
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4644
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:740
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:436
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4024
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2592
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:2032
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2188
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:2804
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:228
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1152
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4004
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4768
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4668
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3844
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4324
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4364
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2008
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2056
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3280
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2708
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3492
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3112
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2452
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1500
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3244
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3164
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4760
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3640
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3032
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3796
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3060
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3104
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3504
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4516
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:2212
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2232
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4520
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:2744
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1964
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:4936
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4060
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3400
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:1952
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1848
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4840
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3712
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:2876
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3036
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:5008
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:4024
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:228
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:244
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:3060
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:640
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:460
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4260
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:4124
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:4272
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:4020
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:4516
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:3492
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:4108
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:4944
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:4044
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:3344
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:4912
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:4072
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:3804
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:3848
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:228
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4516
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4644
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3720
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4580
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4308
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1296
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:852
                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4336
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1944
                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:3356
                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:3344
                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                          explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3320
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3956
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3988
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4796
                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:2508
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:2280
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4516
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2668
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:1600
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:848
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:2188
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3672
                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2336
                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2688
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4324
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2544

                                                                                                                                                                                                                Network

                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                  56ea370e0b713791d433b3a60e627e8b

                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                  3dedbede194e8ce166e23fdf82054931fb8c2455

                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                  312e07f70383f32feab09e4e45718aea0a431820262f89ac4cc09771837e78e6

                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                  54e9d639eb041db573bc5cc9bc89ddd36452650b4b4865e5846b2b88da92f476f44cb283852ebdb0cf5b2c655ca30fdefd41ad8cb0c97c5e6f172f3d2b29e2e1

                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\UAD602VR\microsoft.windows[1].xml
                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  97B

                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                  e9e2ee3a6270d2690cdee33837d08526

                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                  634edbcbfbb53b2c8bff80b36adf9e33b95f7588

                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                  24d8decb4635f7e9b48e7f3e0886cc053ff8f3257eea6820ce048d9a7f75a0b4

                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                  8fd3000eb3f2ae07bcb4e204b9c9e76b6d115613230f5a8a8c3a67eacc744376e54460f12b28c187b1e3afa2eaba40e49c25f5681ebedb91c932a3019d5f6992

                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                • memory/112-265-0x0000000002860000-0x0000000002861000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/228-974-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/436-684-0x000002E944D00000-0x000002E944E00000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/436-698-0x000002E945D90000-0x000002E945DB0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/436-707-0x000002E9461A0000-0x000002E9461C0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/436-689-0x000002E945DD0000-0x000002E945DF0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/916-447-0x000001E1EFAC0000-0x000001E1EFAE0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/916-416-0x000001E1EF4E0000-0x000001E1EF500000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/916-440-0x000001E1EF4A0000-0x000001E1EF4C0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2188-834-0x0000024446500000-0x0000024446600000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2188-851-0x0000024447580000-0x00000244475A0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2188-863-0x0000024447990000-0x00000244479B0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2188-839-0x00000244475C0000-0x00000244475E0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2260-408-0x00000000030D0000-0x00000000030D1000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2592-833-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2724-1-0x0000000074E50000-0x0000000074F23000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  844KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2724-0-0x0000000000BD0000-0x0000000000BD6000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2724-8-0x0000000000BD0000-0x0000000000BD6000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/2724-7-0x0000000074E50000-0x0000000074F23000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  844KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3720-298-0x0000021ED1810000-0x0000021ED1830000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3720-267-0x0000021ED0300000-0x0000021ED0400000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3720-285-0x0000021ED1400000-0x0000021ED1420000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3720-269-0x0000021ED0300000-0x0000021ED0400000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3720-272-0x0000021ED1440000-0x0000021ED1460000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3720-268-0x0000021ED0300000-0x0000021ED0400000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3856-126-0x00000000046B0000-0x00000000046B1000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3940-553-0x00000268B1420000-0x00000268B1440000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3940-548-0x00000268B0300000-0x00000268B0400000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3940-579-0x00000268B17F0000-0x00000268B1810000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3940-565-0x00000268B11E0000-0x00000268B1200000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/3940-549-0x00000268B0300000-0x00000268B0400000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4004-975-0x000001F9DA800000-0x000001F9DA900000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4004-980-0x000001F9DB700000-0x000001F9DB720000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4004-990-0x000001F9DB6C0000-0x000001F9DB6E0000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4004-1003-0x000001F9DBCE0000-0x000001F9DBD00000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4004-976-0x000001F9DA800000-0x000001F9DA900000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4108-12-0x000001E9C6E00000-0x000001E9C6F00000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4108-48-0x000001F1C9310000-0x000001F1C9330000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4108-28-0x000001F1C8F00000-0x000001F1C8F20000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4108-17-0x000001F1C8F40000-0x000001F1C8F60000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4324-1124-0x000001FFC7200000-0x000001FFC7300000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4324-1123-0x000001FFC7200000-0x000001FFC7300000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4324-546-0x0000000004E00000-0x0000000004E01000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4576-11-0x0000000004E90000-0x0000000004E91000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4644-682-0x00000000048B0000-0x00000000048B1000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4668-1121-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4764-134-0x00000250AEB40000-0x00000250AEB60000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4764-145-0x00000250AEB00000-0x00000250AEB20000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4764-163-0x00000250AEF00000-0x00000250AEF20000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                • memory/4764-129-0x00000250ADA00000-0x00000250ADB00000-memory.dmp

                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                  1024KB

                                                                                                                                                                                                                  Download