Overview

overview

10

Static

static

10

installer.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    71s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2024 18:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    installer.exe

  • Size

    195KB

  • MD5

    9dd7f4587140ec81cc261c6d05bac60b

  • SHA1

    6e999875685482810bb236383033195d329b923c

  • SHA256

    5ecf8bf6a98fe1380171b15bafdd0523f2b85d27e7bc4cb73e36a6717a15b93f

  • SHA512

    077224198ea5ac2d9b64a8fca1eb9141be35cee5ed4a625445024dc0939e797450ae7a94d9cb1ae392c7c24dfb8eb6dcd3a0cf2fdcd456640c71467538bb7ee1

  • SSDEEP

    6144:KbemuOXxbzS5llg9JCWWRipfrA4is0rA:KjxxvSl6Fai9rA4iJ

Score
8/10
persistenceransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:540
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6753.bat" "C:\Users\Admin\AppData\Local\Temp\INSTAL~1.EXE""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Windows\SysWOW64\attrib.exe
        attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\INSTAL~1.EXE"
        3⤵
        • Views/modifies file attributes
        PID:4796
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3476
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3984
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4976
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:1836
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3608
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:452
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SendNotifyMessage
    PID:3084
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3256
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1496
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3368
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4716
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2316
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3984
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4356
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3004
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3960
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4012
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1120
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:792
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2168
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3404
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2264
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4744
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:60
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:5016
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:620
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4276
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:4380
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4640
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4468
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:656
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:4632
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3956
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3136
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1400
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:748
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4356
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1488
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3084
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3224
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3628
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3476

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Active Setup

          1
          T1547.014

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Active Setup

          1
          T1547.014

          Defense Evasion

          Modify Registry

          4
          T1112

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Credential Access

          Discovery

          Query Registry

          4
          T1012

          System Information Discovery

          4
          T1082

          Peripheral Device Discovery

          2
          T1120

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Defacement

          1
          T1491

          Resource Development

          Reconnaissance

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
            Filesize

            471B

            MD5

            b4b19f96a22192db9a83ba8a65a2e8d1

            SHA1

            e50926c1b3d5390c2489e1f1c000654bf2c773ff

            SHA256

            91ee46abed31c2de11cdf68d792ef2c6f188ce82edc28bd4eb702c56167c7a7d

            SHA512

            5166f784b73b0f83a0bd9b02cdb89ee560b69b0eff9afff8601edd301ce409a1f42b586c68d4f34b291797527bba6f092777e2e17131b0766a1f93121045331b

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
            Filesize

            420B

            MD5

            6c5c5fc4c3c5950cde3a02156c660a4c

            SHA1

            b27dc355a94ac79466710efb0f591098b5fce363

            SHA256

            e600bbc03f88594144ac2ca12706b73119bfb44d582e38da41b628b7a5b8bbae

            SHA512

            8f49e721c7fc7b5f3b9b5b629e4b5f6876f38304cc9f289df4eeb96e97a8f77c96984bcc37337901bfd3256c53c4db82c4f262321476fa25a8d43e4cf7b49072

            Download Submit
          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
            Filesize

            2KB

            MD5

            5b16f2f4d1aafde1ca6510a06625507a

            SHA1

            7eaf1f8bb9a023f4b26621cd5b2e798011fb9cf7

            SHA256

            007ed6638a0bb1c7d2378685ef8a9448e7b63540cdb1f10bb3ed611721f9635e

            SHA512

            50fbe01860d3713f3a0ba29abc07872e3e73836ef8949a68c47e5ba599aebfeed638c029af18526e908325475edb318c94393f988ab76d22d84b4646ff3c0e3f

            Download Submit
          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133640742466412399.txt
            Filesize

            75KB

            MD5

            79ea60e4feeffe4483ba2d0ea61852fb

            SHA1

            7d5921a1b6240cc717ad4f4478bbcfc42f3af8e8

            SHA256

            1e85f6cd486b20682b1a6af9f34e7993a558f3b5dccd1e80a55178847e794923

            SHA512

            4d0866c2b63af9570fa20bca628a6e67b3704d7ab5a8a1311fb614f38b54444cc6630390092282f075751cae38000a17e4bf1cb992a8900b0c72965c0b24dbf4

            Download Submit
          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WUYU8Y5R\microsoft.windows[1].xml
            Filesize

            97B

            MD5

            1b4430f8816838751064e481b2671dca

            SHA1

            bf5bb7eb34faac1bac77262c8a7f3662981deea7

            SHA256

            1b12191f1bd84731c07f1493d0553255d66f7095a8cd896aec920cc2213db6c4

            SHA512

            bdd215c6eee00376623f2e0fafef0b7e58682352f0f0a63b854ddf25a5ad02703d306fb4acd352a7d2dee5d1f311e930f19d7a67bd36f451e101ce9d6f660bba

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\6753.bat
            Filesize

            76B

            MD5

            9d0cca7367c4b9d1da08b5bc18de2c0f

            SHA1

            c1c3071a10f577141bc2da70eaefae0b926eec06

            SHA256

            47c3071b8dcd36e4971fe79f3da421f10f1040b7c0289250b85a987ec9ce717d

            SHA512

            13932316f629f3c2a3b7a47f65c25b8b22f4929914c703159ec536b0bb71eb1d43b4ef60ea75400e826779ad048b4e62fba259d24cf73c155a6688c290cc7198

            Download Submit
          • memory/60-1062-0x000001E770F80000-0x000001E770FA0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/60-1049-0x000001E770970000-0x000001E770990000-memory.dmp
            Filesize

            128KB

            Download
          • memory/60-1034-0x000001E7709B0000-0x000001E7709D0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/60-1031-0x000001E76FA50000-0x000001E76FB50000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/60-1030-0x000001E76FA50000-0x000001E76FB50000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/60-1029-0x000001E76FA50000-0x000001E76FB50000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/452-183-0x0000021C412B0000-0x0000021C412D0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/452-173-0x0000021C412F0000-0x0000021C41310000-memory.dmp
            Filesize

            128KB

            Download
          • memory/452-169-0x0000021C40400000-0x0000021C40500000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/452-195-0x0000021C418C0000-0x0000021C418E0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/792-875-0x0000000004B90000-0x0000000004B91000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1120-733-0x0000023A04A00000-0x0000023A04B00000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/1120-734-0x0000023A04A00000-0x0000023A04B00000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/1120-738-0x00000242068C0000-0x00000242068E0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/1120-749-0x0000024206880000-0x00000242068A0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/1120-760-0x0000024206EA0000-0x0000024206EC0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/1496-322-0x000001E01D560000-0x000001E01D580000-memory.dmp
            Filesize

            128KB

            Download
          • memory/1496-336-0x000001E01D520000-0x000001E01D540000-memory.dmp
            Filesize

            128KB

            Download
          • memory/1496-352-0x000001E01D920000-0x000001E01D940000-memory.dmp
            Filesize

            128KB

            Download
          • memory/1496-318-0x000001E01C400000-0x000001E01C500000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/1496-319-0x000001E01C400000-0x000001E01C500000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/1496-317-0x000001E01C400000-0x000001E01C500000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/1836-166-0x00000000029F0000-0x00000000029F1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2264-1027-0x0000000004990000-0x0000000004991000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2316-481-0x0000025CB6950000-0x0000025CB6970000-memory.dmp
            Filesize

            128KB

            Download
          • memory/2316-461-0x0000025CB6990000-0x0000025CB69B0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/2316-493-0x0000025CB6F60000-0x0000025CB6F80000-memory.dmp
            Filesize

            128KB

            Download
          • memory/2316-456-0x0000025CB5A40000-0x0000025CB5B40000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/3004-603-0x0000017896020000-0x0000017896040000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3004-625-0x00000178963E0000-0x0000017896400000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3004-615-0x0000017895DD0000-0x0000017895DF0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3004-599-0x0000017894F00000-0x0000017895000000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/3084-315-0x00000000042B0000-0x00000000042B1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3368-454-0x0000000004890000-0x0000000004891000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3404-892-0x00000291199A0000-0x00000291199C0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3404-882-0x00000291199E0000-0x0000029119A00000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3404-903-0x000002911A4C0000-0x000002911A4E0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3404-877-0x0000029119000000-0x0000029119100000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/3920-22-0x000001FC9FA20000-0x000001FC9FA40000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3920-19-0x000001FC9E700000-0x000001FC9E800000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/3920-17-0x000001FC9E700000-0x000001FC9E800000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/3920-18-0x000001FC9E700000-0x000001FC9E800000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/3920-53-0x000001FC9FDF0000-0x000001FC9FE10000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3920-29-0x000001FC9F7E0000-0x000001FC9F800000-memory.dmp
            Filesize

            128KB

            Download
          • memory/3960-731-0x0000000003EA0000-0x0000000003EA1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3984-596-0x00000000028F0000-0x00000000028F1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3984-15-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/4276-1206-0x0000019E60400000-0x0000019E60420000-memory.dmp
            Filesize

            128KB

            Download
          • memory/4276-1193-0x0000019E60000000-0x0000019E60020000-memory.dmp
            Filesize

            128KB

            Download
          • memory/4276-1180-0x0000019E60040000-0x0000019E60060000-memory.dmp
            Filesize

            128KB

            Download
          • memory/4380-1323-0x0000000004130000-0x0000000004131000-memory.dmp
            Filesize

            4KB

            Download
          • memory/4468-1324-0x00000141E4700000-0x00000141E4800000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/4468-1325-0x00000141E4700000-0x00000141E4800000-memory.dmp
            Filesize

            1024KB

            Download
          • memory/5016-1173-0x0000000004250000-0x0000000004251000-memory.dmp
            Filesize

            4KB

            Download