File name:

XClient.exe

Full analysis: https://app.any.run/tasks/6e7614ee-f1cd-4db0-8876-14591b26e99b
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: August 18, 2024, 18:09:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xworm
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1624FB780DAFA5213B6AFED65E009B94

SHA1:

54CA79EC23CC061BF125113161EF60DE58B53AB0

SHA256:

985CAB624C6867C30CA2F2E2C07ADAF081C3AD7433B5FA713B5A8FA7CD37B600

SSDEEP:

1536:BVHpFL10oVEjON3+b5VqFhtBbUzVv6UffxXOzUd:B355N3+bTqPtGzVFxXOzY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • XClient.exe (PID: 6328)

    • Changes the autorun value in the registry

      • XClient.exe (PID: 6328)

    • XWORM has been detected (YARA)

      • XClient.exe (PID: 6328)

    • XWORM has been detected (SURICATA)

      • XClient.exe (PID: 6328)

    • Connects to the CnC server

      • XClient.exe (PID: 6328)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • XClient.exe (PID: 6328)

    • Executable content was dropped or overwritten

      • XClient.exe (PID: 6328)

    • The process creates files with name similar to system file names

      • XClient.exe (PID: 6328)

    • Connects to unusual port

      • XClient.exe (PID: 6328)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 6204)
      • XClient.exe (PID: 6328)
      • StartMenuExperienceHost.exe (PID: 1432)
      • StartMenuExperienceHost.exe (PID: 5720)
      • StartMenuExperienceHost.exe (PID: 3076)

    • Contacting a server suspected of hosting an CnC

      • XClient.exe (PID: 6328)

    • Reads the date of Windows installation

      • StartMenuExperienceHost.exe (PID: 1432)
      • StartMenuExperienceHost.exe (PID: 5720)
      • StartMenuExperienceHost.exe (PID: 3076)

  • INFO

    • Creates files or folders in the user directory

      • XClient.exe (PID: 6328)
      • ShellExperienceHost.exe (PID: 6204)

    • Reads the computer name

      • XClient.exe (PID: 6328)
      • ShellExperienceHost.exe (PID: 6204)
      • TextInputHost.exe (PID: 1128)
      • SearchApp.exe (PID: 3324)
      • TextInputHost.exe (PID: 1104)
      • StartMenuExperienceHost.exe (PID: 1432)
      • StartMenuExperienceHost.exe (PID: 5720)
      • TextInputHost.exe (PID: 3040)
      • SearchApp.exe (PID: 904)
      • StartMenuExperienceHost.exe (PID: 3076)
      • TextInputHost.exe (PID: 6476)
      • SearchApp.exe (PID: 6284)

    • Reads the machine GUID from the registry

      • XClient.exe (PID: 6328)
      • ShellExperienceHost.exe (PID: 6204)
      • SearchApp.exe (PID: 3324)
      • SearchApp.exe (PID: 6284)

    • Checks supported languages

      • XClient.exe (PID: 6328)
      • TextInputHost.exe (PID: 1128)
      • ShellExperienceHost.exe (PID: 6204)
      • TextInputHost.exe (PID: 1104)
      • StartMenuExperienceHost.exe (PID: 1432)
      • SearchApp.exe (PID: 3324)
      • StartMenuExperienceHost.exe (PID: 5720)
      • TextInputHost.exe (PID: 3040)
      • SearchApp.exe (PID: 904)
      • TextInputHost.exe (PID: 6476)
      • StartMenuExperienceHost.exe (PID: 3076)
      • SearchApp.exe (PID: 6284)

    • Create files in a temporary directory

      • XClient.exe (PID: 6328)

    • Process checks computer location settings

      • ShellExperienceHost.exe (PID: 6204)
      • StartMenuExperienceHost.exe (PID: 1432)
      • SearchApp.exe (PID: 3324)
      • StartMenuExperienceHost.exe (PID: 5720)
      • SearchApp.exe (PID: 904)
      • StartMenuExperienceHost.exe (PID: 3076)
      • SearchApp.exe (PID: 6284)

    • Checks proxy server information

      • SearchApp.exe (PID: 3324)
      • SearchApp.exe (PID: 904)
      • SearchApp.exe (PID: 6284)

    • Process checks Internet Explorer phishing filters

      • SearchApp.exe (PID: 3324)
      • SearchApp.exe (PID: 6284)

    • Reads the software policy settings

      • SearchApp.exe (PID: 3324)
      • SearchApp.exe (PID: 6284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6328) XClient.exe
C2127.0.0.1,22.ip.gl.ply.gg:10337
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexLwgi9PVVCh6kT4ka
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:18 17:54:21+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 74752
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x1420e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: XClient.exe
LegalCopyright:
OriginalFileName: XClient.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
18
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XWORM xclient.exe textinputhost.exe no specs shellexperiencehost.exe no specs rundll32.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs tiworker.exe no specs searchapp.exe startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe no specs textinputhost.exe no specs startmenuexperiencehost.exe no specs searchapp.exe textinputhost.exe no specs startmenuexperiencehost.exe no specs searchapp.exe no specs mobsync.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wincorlib.dll
1104"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
1
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
1128"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
1
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
1432"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2336"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
2744"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
3040"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
1
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
3076"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3324"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4116C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
69 602
Read events
69 425
Write events
147
Delete events
30

Modification events

(PID) Process:(6328) XClient.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:svchost
Value:
C:\Users\admin\AppData\Roaming\svchost.exe
(PID) Process:(6328) XClient.exeKey:HKEY_CURRENT_USER\SOFTWARE\3C54740F7CC0F23B53E5
Operation:writeName:CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34
Value:
004A00001F8B0800000000000400ED7C0B785C55B5FF3A6766CE3933939964264D9AB64999D287D3260D4D5FB4D0D2E6D147A06943D3D207423A99394DA69DCC49CF4CA0A15227A2572A96BF28782DE8E575F5D27BD52BA250540444D4A2A8E85FE47AA182A817142FF8FAFE8A5AEF6FAD73E691A628F77EFFEF7EFFEFFBDF69B3CE5E6BEDBDF67AEDB5F73E99B667F7FBC843445EFCFCF9CF4427C8F9ACA5BFFE29E0277CCEE7C2F419FF93B34E289B9E9CB56D289D8B8DD8D6A09D188E2513D9AC958F0D98317B341B4B67635D5BFA62C356CA6C0D8502735C19BDEB8836291EFABB1FBE6416E53E4FE7C6824A2F510710CDA105F600C4DC49896AA4AD3A7A13959FF48843E78F87D6BE8BBBF2DFF2B3F490CF897EA22DAE311FF29CC5C83B88AADE842F267DA09F51811AC03756E0AD79F3609E7559EBF4155BD54922F6B4DA393B49AE6ED0510CED9AD80F22D6B6DA66C64ABABADEE1CADA38A95FC7996ABED2EF3C37CA101F6D5A46F499F9444AB1437F3927DECC67A61A9F8A682D98476ABC010D5AF0B1DC343C0B10E8CD4DE716472D37835B1E6E35720B567917D42E522436E81AA1C33CC06A0233D04C5A89A70A8F455833CFE47984C742AD73CEE47985C7D358B1324FA555E0F98407E89D129F0566506F996563FA916F83A6C6CF05C99A0D9043D206AA8C824FC4C980D21C419254851CAD483E97D402230B2ECB212A5A7C2E46E741500B3A53E1A979EC29A2E2785DC6EBC5F113E9F1106408FDFE29A7B53A20B9B7B04E71769FC1BA9FD6A64FA4FADD69E63BD3D00CD8BB83242F23AC46007C4F013378BD0548F7FA0AD0D31BF616C2781C6699D6020EE1617FA9796AC6DC7833BB8874AB05CFF842A6C65B014F11EBACC8E25268C54A9A019F2903F5856A8CAEDF578870B0CF63BD6A592FD147A78BE1673FEBD330B531B788B910E0AD73BA4F3DBA1A220AD109230F7387187D8DC86A13EDCAF862C61DC26136EE30DB165FC2F15BCAACA9A20B35C49156DABC532131A5A47D1CA91FB8311D882FE701E773ACA36A7C055B7B8EFF28168F32B7DE864D2377CD9D7A98FD75D7DC062DBE12FCBBE64E7309D3A34AFC02F68B439EE1921B41BEB04C6E72C9330FB3A7EF8AAF6256032790A33B1B5C2FF0C6743DE25ACF71852B02C2B62E426BDEA93A2712218A4FE391452BE058A59163B09F02A3149A2DCBE9627A798952C76DF6F9EF15F113724D42735A09682D9A23C5F59E6AAD9175507F5AAD3256F2DA3D1C91B09C5642FE950F7237D1F1260CAEF546BC2BDFCB248E8EB5966D99C3F9DECE11E3610EA38327AD086344D202E37D115FCB7237E26FDEFEE7967389122953F7FDE081A94F9773859AA738CAB84A5A9D622FADF80C15D57438BAD5251924FAAD63F92C0E2A6911AD65F0300A99B745974773FDE17A666917B12AEBD1756E81E9B90D68D6EA11BD6CBCB5916516ED399BE9532B553DD7B1A1ACC30F269943D4EC77A37CAAF33F9121F54E86D41A135244E114A1F646A75E4FC1CF93F0E40BF88110727244251410AE3D5C27E28D32B3BBF203A49D65E52F28AE7B5486198E0C1F7D80643F820CC7F8801A9FCD89810AA505F51BD3B21A6C081D8977B34466566946BD7163DA098CA6D7EBC5B6185637D5BA984D13441377D76BE2B507EAAD4BC4E82AD25A74CDDAC4639E7DE345C26B4445E531B3C5ED5DA1436FA3BAA2FD5F0125C4BA3BF5CB99DEEA2969626DAE2C8767778A9B585BCA39D6F1D76B283985B7B7B267151967EDE99FD43344FEB34507462D25D949A6C59CF81076BE69DB8BED03147E7BB17D1B858F97637812A3C2EC87159F472BB6681475F2D27299B5B6B2F5DACAEBA818E4A07D1E07B414E82AE3EC810EE9FE7A7F31B87A45D027075A7702AD4F0874BC4FECAE22BD45D7DD70139572DE7B46C4696AAD6FC5EA3FF311D78DFD02B28E15631FA10F1DA7FAA2CDDFC7F1A2DACDFD38DBC1E54C4A765D7D7C9B13EEFA5B837A7CB1D8177BA1EDA98796AD3162F76EEF3FBC6CBA11AB9E7E817AE17779D992436C3DB0C254F90C58F748F89317FEC4E5F0B00B3FC87569A330AB4E4E7F9287EF5CFFD413ADFB9B5DCA8577708F79D2E3C427BEF4BF5BAB99F3C3A77FF3A7D6B615D520EB36769691FAF87628B6F276EECCF55DB72F2D531F66EA8B424D96A93F62EA93423D54A63EC3D407847A5D99FA6BA6DE29D41BCA540D84153708F56FCBD4185347857A7B997A3E53FBB966C7CFE1F0FB0F5FC6A9B0438215F1B634F86375E04ECDEDE42A26BC99BC4B63D4FCD228DE2B2AC671999E16F1C9C0FAB30C7C8D63EBE4C18A1F735B9B7A6B7C177A680DCE33B79B91692E71BAF3E4B58301F7FDD501F1369E67C57B8A1D97B81DF999BB9C3BBC55AAD83487545F5F3F95CF971A35EF26EE7785EC1D3CF24A29D311A33EA22FF434342BF587FB79F8B92CBF7921D5C7F770077FC46FDF0B8FF288843BD700F79BCB499AE4B990FBA79ADC2510A048E0ACC5A058FBD9AD0F20834EE0A7C9ADFDB58B3C84C5C467669C3953BCA0EBAB50844346ADD70FF77B6BB5E6B7E811ED560BD7B580EA04974F01D803B110C108344728A24D7D9AA313F1B57D774AE9AC1D9195C672F7F2586B90DC8338F119D8E1472BF84315FC198BBCC417C45A675DE6D2ACD974D924AB503DA65BFBB82818F5F1FD5205F5FA5C4632CB3FF507EE5ECACA477CF57E6B987B467C8153D309796744BCC5EA515149644EA74EB4505337974067BFD8BCC3A919ACCF5B9DFD3352AC7C2A2A5D96CBB52824C58CF4A9A248C8AFD6836D594CF45B236EEDF2B7E87E7746A7C8052616346D81A3C31CAA5BE9CCABE2F4BE7E735907F890EA5887DC01562167CB76A11B87F9282F85D6CA8164E5A5CC3658A3F2B4AE629D54B827E2AD8FE00C615D2D93CF7453C74711DF5F3ADF87E8820DD4E4D4CBFFB20E07FFEFE980332DC9F925E29CE2D55BE5FC1E249CBBC7D0C0E31A3C6281D83CCA1D7276D4F8DB242E605DEBF4382C6BD4B0DE8EA761158AAB3D16A36F9035CE3A44BDDFAE2DDE08E3EF00B81687766FD41B5FE0D6A6967511EFA1697CC4730F914BFC16AA6800545C78BD87104C6FB1DDE4B4A7B38F9A79A1FBAD774ACAF00D2D706A61657238179589C6E4DEC5EE72DD5291AF8BE8D6278AFB5A98BEF634CD2AC6E94AAEAFEC236FBC852F939AF537ECABF8BBC5DDD07E2E696AEE7A8942831B050D6B397EA43200C56C3F8CBA17F0ECCBDDC0EEB43FCB9B7B8C0BFBD4DC7BDD9A6E1D658F1A77B967855ABD1E354E8F1AF11B455EE99A551B8806E49E55EB7764D706B548106961FD2FEE58BE7C1D9A78F98A049DDBC63C2E7FEFA389F730FFD9EF61FE37770F3B15A64810B521583C48862306503D7E9384E8593A55E33AA8AA7C7F941349E9AC359D8273A9817DAFD2DDF48EB98A5B43DE460F2E73DAB0869E5EAFD438F1F1108A0335707CA2CAE93A24B3AA22D46B3935F443313E071DC2C6E6FD41957E689660E7301632A63EED9FFAB464034E3D11AFE435875332AF5653235A03DFC570E185513E58E1738D8AB8EF19783DA9B48EEA763B758E736518B9324DD6F47F31D8BE7A2C005F549B146C030920C1D6DD60FBE3E77100DFCFCE5FC40B29807DAB22338388C45BB09739A9595BCECD2A8A549D999B9140C4FF2632C7FF1732473F7BE6E86F3E73FC70B2BF9C391AFB7C72E684CEC81C59C3ED292733AE77EE1F748B9313E4E41111B3BF859F250A919B44F2AA6F359F4140EBACA0F3A78DC782B64D71DE7B3A7B3C5709CE508AC41EFF48E378406D995B1F6C9EA2EA16EE6C012D11FB8042CAEE803E75675057AD9B413B4F6D7EA1B88F4739473837544FFC1636FC83E58D9ADF5971F169147EFC6FE98CF7704D4CFF764DB18A967855C5BD5F8D7F882ADECFF1B964A6D0DFEBC3AC534E2B41BDC588C39AE640B38F54E9388F3CA7EB982DAF1DE7BBCB50CE14D80DE81C197FE8564EC1DB389BF5F71A8EAC2AA3654A1CEE6B0E3A6CDDFAB053827591BBB5284DCD7D84AB3D7759D09A43B0B502BF0E58B0D893C71D6C06BFF284F11D7D177728EE9B53B6E7AAA5AD8B5A972C5AD2B692293EC241804EC0F4D9D869E6E0D4F00A2E19B3FBF2763A3B98E31E3558D6DFE0186DEFA36767B9F1DAB0BD9B5FF7BE02FC6B3AF08E8C35508EBBB2A3E9AE263FE4D0EBCA12DE0079F67E672FA4599C4FF8611F7CC43DEF7539FEE0779EFCDE4D8CF554B41597C74FDDE539AFA5BFAE3B966934CD97ACD2E86F04BEE63916ACA6C7F80527B57957FB35FAA3C0611FC39502B70A3C28F4266F13461DF330FCB2503EE01DD102F405CFEDB856253DB7EB01F27A6FD7C3B4D0F3EB60985E0F3C10D4E8E3DE63686FF4AEAA0AD31EEF4645A3F3C351234C5F0A709F1784F23B95294D340A09FFE0396668F45DE8A6D1610FEBF9AEC07580EFF1C7FD015AEDA9C5BCFB95359A466FF5478D000D853D618D7EA17F0739385FFBBA16A54FA85F07F70466D1E8D5F01A500EF97741CF1FE9DF00C5568E546BF4733FC376E34875944EF879D4FB820CBF1AD805F8E9D02E48F8AECA12DE21F01FAB5763F68D32FB1F21334CB3945555017A593B160CD07DD59E70807EA5327C4E657D3EE5638B0643ABAAEAE9FD4667081ED358CE253AEBFCFB2AEEF36BE81CA0B5D2FF2A99E543C4A36A431BB1C93CA130FC3224687424C85CA33A6A44E9E5F0D7B57A9A176499D70BFD7158BA464905388E0FA8DF01ECD5E6C1BA53019E6BAECA56B7186CEF3481CB54B6BA29CC96EE54D96AF2B3C786F5A6AA28D901B6BD2BC81EBE3BC4FE5F8859387BD29243C555F22B2353DD5DC27E17C854F7A0CD795D43178533D55700F34832FE5DD5CD555720330DE1C54399EA77213F83C2FB7E35F73450F7B8C6DC6FDC6F30562D52178418C3D949780361C6AA718B60DE77AA189BC2B50CE80301076B12DE937E079B2F586F356375D42A3D71BE25C616930FD84F820EB644B016977701F9B0FCFE5DB07A5A4501F0BECA7251CDD708769F608DC0788D6D909E335DDEE230F3665207EAF7C2409DB78DBC8126C086C05CC0F58185DE086D359601D6795602FE1FE5226F3DEA7907E0150267546F00AC11F83362F84581B7097C9F7231E08FA90770B9BE15F09AC076C0176997F7D2C2ED74A577162DAE3EE5594E9FA204E8B87B79353AEDBB123014623837F83DACB9B785F6A1BDAF9A292F093C1866F87D3FC3EBA57D8171A5B7372695A3E17CAC4785764EC006048B34AC0E3E0CECBD82D51A3F0F64BD0ADDE3623F3272C0BEEC625F0C1C04F6BC8B7D2F782DB03FBAD878E01DC0BA6639D89FD47703BBDCC5FC9EA3C052B3CAF3A974CDACB22E2ABD53B07AE3E3E19BBD2A7DD81D3723C4D87D13C6BD3061DC2BCE38DAEF3FE69DC8D369CFB9E571FA19BCB79DEB8CEB0D33EFB5D90EF692EF2EAF4E53E639584239EE3568A78B3DA27C0EB57ACA5B1CECC3CAC3C8EDC6B8835DA031563943806AE63BBCBD90E2DC2D0A541FFB66E89FBDC112B64FFD8CB7AA84ADAAFE82B7866A5A9C711FF43FE2AD29F19E0B7FD51B71B1DAD853E16F233786DC9E37E1F2309DAE77B1E769976706DDE362BF0B3DE36DA4150B1DEC55604DF40517DB177CC63B93D6B63AD82660E74CB021E6CE17897DD4FF436F197BCCF829B2F4CB322E42D71AFFEE9D4B2F9DE74899EBF9AD77DE0429F32BEC3BED9D4FD7B7393DFFD5AFFAE6D394C50EB65DF5FB16D06F9648DCE90F38C0B6D02239CD7F455D15FA846721F5BA588DAA29AD3424D875F433B5DED74AEF747927B4FB51293EBCD4D12CACCC00EF71C1147A9D66FBCEA36F2D2D6BB6889E15CC63FC9BB20558D3B24A5EA50D8B68F1B2722E2DA28B9639E382B45B99D8B3AD64EDFC70B3AF8C5D51BDC4B744F4F88E8FE1278977F767590A7D89F83DF71788F7FF130A735FF2335C2AED9F6815ED10C3CF2B3CF6058DC706F99D3579B938D3E322DF17626EBA9AB9F26B26CA8558B2253237E8CCBDD2602EF7F4BAF429E1F22CB1EAC95005ECD4B97DB368FE9268FE8A68FE90CCBE57E4B4F2AF59E99470AF14691F5327D28B73DD2FFD75B50C152A5B7785F4795CDA1F0DB3B45F55F9E9FCA082B8B29FA70106905BE7076BE073862B05B60BEC1678A9C05D80759490765AE001816380D3E908608CEE1499C705DE2BF02420F2587ABE2C945F0ABC49E031815502A7086C1438C7A5733E4D11D828708EC0076949683F3D4537AB07003F563D46BF47FFB7D3BDCA3F2947C9AFF0D807016FA308E09DE8CF9488A262D77F54A90BFE334D53AE54EFA793CA17D4CF81E2412ECE9751B300BF0DD8808BC82CC507F84BE596C073686F0FFF887EAFEC0CBD04F86EE355C08F077F4B2B95DFFAFE803E273445695366E91AE0B561206A7D38A0F855D66196F292AF4699A53CE76B53E62B5755AF507EA9FC405BAD4C532FF760552B7FEFEB00FDA0670360B3BE45E92E69DEA7B0CEBB459ACD12F483808F280565BE8C855602B93D4DE57644A9AB66F8B0FF387ABE43F9A4D2A66E44655EA9DE1A7E4CE956FF51FBA672A97A9FFF7B8027AB9F01E44CD8A56EA7E7A80D339E52122AC3B4BAC5FF6365979A327E0EF849DF6BCA018CFAAD32A6D6EABF137DFE0CFA7B344D3DA2FE6B55957AA9F2FED06CC0AFC0AB37A97BE83CF526F5E5AA65808F6A6B54F6ED76C0BDCAE5EA31CC95547781B20FD0A1BC5C358E367B609712D235EC171C8BB4C0E3EAABDAADEABDEA78F576C046F54EC083C17BD403CA2EFD9368EF467BA5787EA5787E0CA39E50C7954BD4EF826E8599FEB85F534EAADCE7A4CA7DC695ACF1ACFA2FEA12ED67E8D9AEBC06B81C678131F1C0499563DAA69CAC6EF030E55C0FE7498BE705F5D1EA36CF1150967B6E52D86F3729AFEB17795E569F09ACF39C549FF16DF2EC526FD376817247B8C573A97A63F8168FA25E1FBA1DB019B3FF523DE9BBC7F320711D7E90B8FE3E485C697FAF3EA37CD9B354CE2BABE8B3BE2D386D3DECFB2DDAEC01837AA906F5FE6ECAEAAD382F26518B6B290338836E009C4D370336D33F002E1178A1503AE913809708A54FE0E5F43860925E05DC4F7FF4AD45DDAFF1AEA543D4A575528E7A00B9DD8DB9DEAE278592144A1A940FE805E97F1DDD20F00302B9CF1170EFD0EF10EEDDC2BD1BF4BDDADDF44FD2BE4F20F73F0E691EFD11E9F998D01F43CF7BB4C7847E52E0F3C27D51E4BC28A35E14392F4A7FBF72377D46BF4E11AEC2148FCA1A7AD4DBA84A9F2DEDD92ADBDBA932778FC6943D1ACB2C48BB20ED3BA47D87B41F91F623D27E5E20E90C632E64EE5A69EF71A1F497F6C5B40D95F14A78F5DDF441BA871EC37AEC574CE506E556E5D34AADBA40BD505DA7E6D577AB0FA8BF51FB3D239E5B3D7FEFF9B4E77ECFE73DDFF278799FC11F3E49E98874446EB1AF072EC0DEF61B630DE097025D80FF16EC067C5760336093A70FF053E15D3EBE1B30FCB972A54FC5FEE191EF3FF900599E8A1FBFBC6D0FCA7BFF10FF6E1B50C54F3560985F29E0945F4B8FE89FD53763BF5F86BCEBA4473DDFF7FCD4F30BCF1F3C6B950BE99B2185D62BAB699FAA52A7B2865655F3B3939E0BF3AD661D3D15E62D673B7DD42F77797ACCE067BFF423659CE60BFF3ABA02B8B750F1AD2CF93CE9A7F2F7DEF039ED59281D26D29C7B57A082A6E3BE7C663FDDFB756DF2D8CE50B1CD03EEA9E277125E7E818CFB5400B687B0BF8470DB09E3EC5447CC3D977E2A4F4B9EFC9BE59FD212E509CF12E535E7DB75894534A77BEB8A856DD4BF29313C904ACCE9EF17745B1B755A59FE5ADC6589CCA8B9079421DB4CA4FA127BCD2D03FBCC64BED7B6AE4AA74C1BACED39D35EB298469DC736AB3B9BE7E7621A34F3FDDBB7AD5F41AB7AACD468C6BC8856F5DAE9AB1279B37B7824630E9BD97C229FB6B25D663E91CEE42EA2BE0E1AEAEAA40D9DD4DDD5459DDBB7F66DD9DADFB771CB8EEECD1B682374A5DE2DDD9BB7B5F776A31AF4F56EA2BE4DD4E3F6EBDEBC7E0BF58DE5F2E6706BF716549A4BA9A38F7AFA90D53BE99275BBA8BF3363E5466D133652573A3762E5CCFEFEEE6C2E9FC826D1A24E18989F4882916C6B57229FA0E15CD2B233E901DA6A66CC44CEDC984AD20633CF8F9E74D2B672D6DE7CEB65E9DC6822D391C8A5517392D4610EA6B35BE137D77DB435BD2F9B4A98999E44363168A6C44370741693004BE72ADBD0315942FBC6B2C921DBCAA6AF615E8A86766441340186AE06E8B4864712B6D963E687AC946B49D10E99049A96F094B937319A29E3E96283CD49E4863AAD9449390CEAE1068BB6CD5C0E7172F0F4C890694BB30F9E48E6A5B9DEB686BB8761130B711A3C6D0F06729B352DB6BB1DE7270632266D1DCDE6D3C3E6B6B1117363229BCAC870C6589E4B19721E5B3155223B88D6FA34C00E3B9D3737A5B3EE3CAE10927495166297B792564610572AF559C9FD6E535C0F372023C4D8621BB65AA376D22CE29D891179B68F8C64D249C957C47702DE67E6F3FCDE50E89C656631C1685D2A9DB7EC0EDBBA5A0CEE43C2BBBA8B636189BDC1CC9A36C8A9F67CDE4E0F8C82B561345D816D343323979863575B766597E2288E5699DC650E8C0E0E9AF6662BCBCBF26C4CD6A34C3B43C13203EA219BD31368EDB99C393C9019DB96CE57926115B2DA4E39ABBC4271140887B639317C36317622650E27ECFD65D6B6848DC0ACB7D11FF6EE9F6C1864A6CCEC64599C14979936A76999D933B6C1B646473AAD0C27EA0456715C97994BDAE991894C2734125BACF6C44169E5260F468EA54693F9C98C4E6B64CC4E0F0E9D9585A59A1D2B33DC3520F47C7A209D49E72BB8922B1D63EC1A4B1E9CB792E592B54E0BE9ED546507ED4B5C85C066535832661A4DB70C39088FEF4319A1E4803C580A2FCF8ED1BD7B4DBB4472BB575219706BCB5EEA45BA178BAD53DA98B02E9BB452159C2E3B7135D056AE071564D7E056375CCCE1E5CEAB67F952E7153C1B5B89BAF5ADC4741BB0DB6D4D9C113D365978F4E40651B7079DE41121702997B862DB192D94F5995140485C6F65B0AFF526F243E2AB1DE994DBDA646607D1745CE22223C9340D5CB61FD14581EE4C64320389E47E426267737B2D7B787D3A8BED2083AA433D093B3794C89C7DB368ED19EB33EDABD24933D78AEDD3B431AC6813AB6A65B15772A1CDB8DB6C6B2A830E1B3B2DDB94E65673D8CA9B48E6FD796B4428BD487ADAB03B3D021BCDC430F5A0873DE6226C4E6F02AB8C32CEE36AE7E14C89C7F0B009D724DB33831612706898D847656CC0CAE7AD61EAEEB4C746F256C9DC52F1C4FE46037D494004D2B2B0616689D704C7B92F699B665662E7B444193B8D4230E652CE6A792BAC4B0F66A937338A6CA2A16EEC8EC401974669E76FADD8B0447445A14641A8C458A3DEF44133B365846B69DAAA9839BB373D383A91B821630D2432E96B2610B79A7BDDDA22CBA6D7CAA505597730698E381D9376961739A5AE5E77306F27BAB37B2D922D92AB73525077B391361C230BC9B48B68E7A89DB31C6CB7695BD491CE0F2746A82F639A2362E2366B64620694BD0B7B2961534FD73227566E9A158F6F34CCFE9978A4038DF78E494477CD4C66F48CED30078AF97B06B76FC44CA613196751916B98BB8644F7ADE594814B6CE7FC6872AB148B94D96539D9C0FBA5EC87EE60D6B3285432D8CC0B8121BC84305E65DA79B773517F6441A9D989D4B4DD63DE3ADBB630AB999F800F39DEA77604194757B45A930E94470F0A183FDBD7F5F5779949F1B1ED9EC0CA3873A1E6046E19DF0E8B7BF3366DB0132343E964AE54CDD289C1AC95CB33890DE8B046B3A9DC1B54902E53DCEFD4AC7238684270DE60EC84B38CDBF38C622D55C91AF92B828A317A23296FC8779320E7AE6ED4C3C9B412A1D52EB19C63016A38970868E59C3173CEB6D99EC9F09699E3D5E034B2EB3389C19C7B0C74DAA9AB9DE75E87E3FE06587649F758475C9CDD2696BB699B382CAF3B00A34BFAEF4867533841B5AE47117406636E6701E6C8C942AE47394A768CA272A231E2AE4F140C273987B03F940ECF6E4AE78A870327E57393523D474EE9B2D07212174EC9758DA4DBAFC67699459B12A556B130C269C962D3D57FB3996F759C22EA2215480A23DB8336D4722CE44338392B1C5E71D709B9E72BE79CE15E61B01530279346F97624BB7BE8DE3C651830B6D1E43312C94989AC91FE7507390FD379540D9C825043018652C98E8CD3BDCBB9B850B7ECB6480746D665AF4AE362C49749DA6F8E0DA4FACDABB83D6C61A774DBBD569A61D16B7C8972EFB3F9849D7703C4DD00DA07186EC4B2C3C50845A274CCE17F23C64550AEC5CE41C136076D5E938E73DC12EC22D8D1B2AED72875B09CD72870EDB69D18A3D498EC1838D917A7E83393A3C8DBB156A7540F72391873B2C93D3C527B2AC5715B9F184E03BB143988FEECBAEEAC79C0C5CAE98A00213D40C267562FE1F0408394A62CB5D256C2898E2C506C4A4A9BF4ADD4450B49E17703C15EEAA6CDB481D610D5F5A1878DBE19FCE9C2F36A48A04825753B8D104DED44CB82241C138567E24FD695DBEC3E774236F74BA3C77ED02E411FE817E9121DF6A307CB8434CF5B31739A8629019D4D3A8FF6816ACAF71BBD97DFD039F8AB0B7B6EDEFCF8EB0F9FFC4E8EBC3145313C31527C6844228C8619A8BE98AA84C3426DD7635EB4C361AD2EDAA544AB9C87E13C12CE63AD5707C71BA35AE296C120C160ADAE7BA2D7AAD16B7DA4AA8D8D3A29D174A4F0942F46D1C2F7749E044F1F3A16C60DF00AFF82BF3CAE8115686CD0A040B4F09CA6AB8DD1C2518D183B0A7DC35E34E5F55395EE3522856391C247C0A98A799448E1E548E11791C22FD1C5088B1D8646D4142DFCC947C43046E82DF018FA84D97EC3874653B826A6450B7736F90C2332EE8F8EFB1AAB75BF6AA8FC89168EB00631C5400F18DAE4C3D88038CBA7635A1E04410147E38F32BD51EC3A0A0DA3855B9A7C4D3E2070033C09C3554C1109C4BC863B5B987B1D2DFD0DEB9A5A1EA5B2B92C5EADD1834DE1B0BF416D50551F7C7734405E10C210314B238F110EABAAD6C0CE6E10171A063B2D32DE06092A7BCD1756B569A08523E3ED18C07185ED4DBEB046F05493AF5A8781C7E1ADE3067F54C775C71193261FFB6FBC1B4981EE1E5DE1F490111A2B095D31F213E805D39BD827621AC4F2D30F5DA2E3A1C8F8A57087DB1DBD656A23EA48B8375AF86CB4F0A058ACF1244D3EF66664FC0A4997078D98876906FAEBD1C24312F287A28547239BE04D8480FD98902C7A343A6E86629AC21670728CA73191114DC3830DB3F5900CBB255A781C86450B27E1E8A38D6A3189403FEA87FF043FE6E86D3AA9A2347AB5E8F8015D6807106A76CDE3ECB8C61A95730F163A22259D7C358E9E3BA1B128DA30470F3756CE3C61D6875427F498A8010B48F51B48228F014773F81B1B81A98DC06471A57DBA3A135ACE245F8D4233C91B506612D65A2D56A02A6BB296743C87F1741F6A2DF7AA258E0F3038F2816BDE7AD9B4A5CF1F313EB5A6FFED91EF052EF0CA17A6DC75EE3E0DF799709F6B3D5AF45AF8A1308E4603378EA81A924AE5E64DAA16F02098DCBE45D50C74D9C8ED8F7AB448AF17E953C5C0609060B096C1B5B22EC79DD53DCE9406837C8D61A93942BC13FE5464C519864EDE8606A3A1018BBF41E3601F0FA3B7849A79AACFE7E7FC96EC41CED7443631B5C1309CDE0F190671913886E54A6438B4069DD446A661063FD63445D37A8D028FC2A78B1445A999C92FD31B1A6A223BB166D0F07B0DB6C5605B0CB6C5605B0CB6C5605BB8D9E08D231886E2FE0BEA99FC4BD96D6AFD0E6C4E9BAD6CE99A83FD14072005FD9CAFA645150A4DBC92C85772B04B28142DBD1E897DE9782CB678D1E2C544F3159AB378E5DEF3CF4F2C4E2C34932BF62E5C9A5C965CB862E5CAE4C2C5CBDB12038915CB536DE6F9445598A3AD7511FF21DAA0D0F4D6CDEBB6955E19B5B8AF1556F337FEA06A784A89C52FE53289317E1955C36362254E6CA951FCE2538342819EB16DE630BAE64DA3AD3453BB424BCE3CAEB66EC3E536D78A53A3951DCC8CF18BC55491D9319AE63B8FD1B6BC2861B742979C796EEECB8FA6D256ABF31A0E92DC9DDBB9EB9A7689D097E6779FFC96CB7DF367D97E486E73451B8AFBCDC084424B8B875273A0B5F456A1F83A14535889918DF9FC8873362BD2A3935F7FD79EED2D3911166A10C7F3D2158A6A150A835079B396188126F7B36287CA7B48514AE960CD1FFE27A1DF7CE2D52F72206EC24F6692BB8B2D7EA76EDA2DB1E24BF9965831EA4B1D67B7C4DC2BF5EAAC398A4B77A625D63B3A00FD70DCDA66ED37B3AB079069CB92CB96B7AD5CB2D45CB462E5ECC9933967EF2201AA56FE9F00BDED5DFC97757EBEBF4C7E9DDB313AEBE795FE4A0C4749BB2B93E949A4B3CE2F174CE7550E7FFE3C17326ACE2AE47F3EFF9F7C9CEF683714FF978D0A3AAF8F4567A1F387FFEF889DE0ACAAF8FF335679F84B4D97E154DE0FB80E67FF3E9CEEB7E07CDF2FA7FCF5CEFFBA410F795F3D4DEE776E2A65AE7131FE7DE419FF2D867C875981D404CEEDEB71AACFE08CDE8D53FF5EF91714447364D4367013A0E6C04F106E56E0665D099FF27E58BEEBD307BA2DB793C1B3483A287D1695FE2CA501F77BF3EC8F4EF419C61FBE6FE429E74A3EB7823722F38FC1DA84F42BEBCFDF542DCEE7DC4292A2C7C8043DF9BE340C2C5FEAB51F6DB9A9400FA342C665F8B1C12F8F6DC37D6B51E987E7E46FC0768BAEDC370B9D32159ABDF15CAD9492FB16C799656C921B118FEE14FE98683E4843C4FF9FC9645A8C8EE327468BF9FB6BC45FB45B203E2ACB712295120D38A6FB4BDE24F4E239B7B8F2D2AEDE45BBB3FF29FD5789DF7BE5B697C22D34891E95B1F94BFE5E2AFE9E38F64CAF9FE9F31532A61D3D722279005A8CC1137F6DDC7FEB678FF36F15AAFEDB27FE9FCFFF0B9FFF00182C66F0004A0000
(PID) Process:(6204) ShellExperienceHost.exeKey:\REGISTRY\A\{b0c604fa-d8cb-1472-7190-1cc25edf0acf}\LocalState
Operation:writeName:IsSketchpadInkSaved
Value:
00408326F999F1DA01
(PID) Process:(6204) ShellExperienceHost.exeKey:\REGISTRY\A\{b0c604fa-d8cb-1472-7190-1cc25edf0acf}\LocalState
Operation:writeName:IsSketchpadInkSaved
Value:
0144E728F999F1DA01
(PID) Process:(6204) ShellExperienceHost.exeKey:\REGISTRY\A\{b0c604fa-d8cb-1472-7190-1cc25edf0acf}\LocalState
Operation:writeName:IsInkSavedToastNeeded
Value:
00088F39F999F1DA01
(PID) Process:(6204) ShellExperienceHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\yYpHriFUdyS-r81lKl88jPGlZr-M05PzoCQ_A6O0gXA\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Voices
Operation:writeName:DefaultTokenId
Value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_DavidM
(PID) Process:(6204) ShellExperienceHost.exeKey:\REGISTRY\A\{b0c604fa-d8cb-1472-7190-1cc25edf0acf}\LocalState\ClockFlyoutCache
Operation:delete valueName:20240722
Value:
(PID) Process:(6204) ShellExperienceHost.exeKey:\REGISTRY\A\{b0c604fa-d8cb-1472-7190-1cc25edf0acf}\LocalState\ClockFlyoutCache
Operation:delete valueName:20240708
Value:
(PID) Process:(6204) ShellExperienceHost.exeKey:\REGISTRY\A\{b0c604fa-d8cb-1472-7190-1cc25edf0acf}\LocalState\ClockFlyoutCache
Operation:delete valueName:20240702
Value:
(PID) Process:(6204) ShellExperienceHost.exeKey:\REGISTRY\A\{b0c604fa-d8cb-1472-7190-1cc25edf0acf}\LocalState\ClockFlyoutCache
Operation:delete valueName:20240727
Value:
Executable files
2
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6204ShellExperienceHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\InkWorkspaceUnifiedTileModelCache.dat~RFf285f.TMP —
MD5:—
SHA256:—
6204ShellExperienceHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\InkWorkspaceUnifiedTileModelCache.dat~RFf2fd1.TMPbinary
MD5:ABC4F3AC5EAE570C119FA4B6959A36D3
SHA256:AF09DD34003723146A5F09B85CF6ADF842C5686C5C9D98359118F53F36AEF92B
6328XClient.exeC:\Users\admin\AppData\Local\Temp\Log.tmptext
MD5:8885AA0E3B414EC3308429E89B5CCBC8
SHA256:3EFF5F0E7D156E9C56004CDD2F4493AE43581A0C4C598639C21C9EF7EF1F432E
6328XClient.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:1624FB780DAFA5213B6AFED65E009B94
SHA256:985CAB624C6867C30CA2F2E2C07ADAF081C3AD7433B5FA713B5A8FA7CD37B600
6328XClient.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnkbinary
MD5:3460541301C4C670DA7A5B06FDB79A83
SHA256:B91A84A941BE8F6993D1C3013628710DDCE4FF5B5F91878784D51756C3ED9DFF
6204ShellExperienceHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\~nkWorkspaceUnifiedTileModelCache.tmpbinary
MD5:ABC4F3AC5EAE570C119FA4B6959A36D3
SHA256:AF09DD34003723146A5F09B85CF6ADF842C5686C5C9D98359118F53F36AEF92B
6872TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:9FAFF07AFCF439E267A8D64E6B4490D2
SHA256:EEB1105D72324781B94953A005A63089AE96474212EF88A7BD57DF5EBE9F876D
6328XClient.exeC:\Users\admin\AppData\Local\Temp\tmp46AB.tmpexecutable
MD5:1B942FAA8E8B1008A8C3C1004BA57349
SHA256:555CCB7ECD9AE52A75135FDD81AB443A49D5785B0621ED6468D28C4234E46CCC
3324SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:6A2BC3A660222C883AA3695D1C2743C6
SHA256:D71B9D22811F4FE010CFA1E10CC508627BFE0200F4187B20D413CCAD67007227
6204ShellExperienceHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\InkWorkspaceUnifiedTileModelCache.datbinary
MD5:ABC4F3AC5EAE570C119FA4B6959A36D3
SHA256:AF09DD34003723146A5F09B85CF6ADF842C5686C5C9D98359118F53F36AEF92B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
98
DNS requests
62
Threats
107

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3324
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6820
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4540
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6160
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2536
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1536
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6328
XClient.exe
147.185.221.22:10337
22.ip.gl.ply.gg
PLAYIT-GG
US
malicious
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4540
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4540
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.206
whitelisted
22.ip.gl.ply.gg
  • 147.185.221.22
malicious
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.0
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.71
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 2.16.110.171
  • 2.16.110.121
  • 2.23.209.133
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.185
  • 2.23.209.130
  • 2.23.209.189
  • 2.23.209.187
  • 2.23.209.135
  • 104.126.37.144
  • 104.126.37.155
  • 104.126.37.152
  • 104.126.37.139
  • 104.126.37.154
  • 104.126.37.169
  • 104.126.37.161
  • 104.126.37.145
  • 104.126.37.176
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Tunneling Service in DNS Lookup (* .ply .gg)
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
105 ETPRO signatures available at the full report
Process
Message
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
XClient.exe
Conversion from string "" to type 'Integer' is not valid.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
XClient.exe