Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

3a34c1f42e...JC.exe

windows7-x64

8

3a34c1f42e...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    19s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2023, 10:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a34c1f42e09bfexeexe_JC.exe

  • Size

    3.3MB

  • MD5

    3a34c1f42e09bf5f06cac038f3d2b9b8

  • SHA1

    4c9498e5849b37a2819dff1773be3d3f71dead1e

  • SHA256

    1a03a844ddeb7ca509eaf41ce41b9f116be6bec14811a7c98b5609eb473ac539

  • SHA512

    3d796fb9f272d26252b251defc474cc2e55685e891cf2e3c17da1d3b58140461b4fe530a62edf8c9fd27faf075461790fb85d1b75c1ac339db2094633ec73393

  • SSDEEP

    49152:k9yiCJ5rFwnANZGEXep+9TxFegOSDAmosh3ANkTTllUbp5mMaYtM/Z9:rJ5rFwnApezgOS9V3AMqrGZ9

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 49 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a34c1f42e09bfexeexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\3a34c1f42e09bfexeexe_JC.exe"
    1⤵
      PID:4004
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:964
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 964 -s 6248
        2⤵
        • Program crash
        PID:4640
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:640
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 452 -p 964 -ip 964
        1⤵
          PID:3764
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4108
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4108 -s 5888
            2⤵
            • Program crash
            PID:3120
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3404
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 568 -p 4108 -ip 4108
          1⤵
            PID:4576
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3084
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3084 -s 7336
              2⤵
              • Program crash
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:640
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4568
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3440
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 3440 -s 3816
                  2⤵
                  • Program crash
                  PID:4680
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 580 -p 3440 -ip 3440
                1⤵
                  PID:3100
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 416 -p 3084 -ip 3084
                  1⤵
                    PID:4464
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Modifies registry class
                    • Suspicious use of SendNotifyMessage
                    PID:3676
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 3676 -s 7244
                      2⤵
                      • Program crash
                      PID:4128
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:228
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:3480
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 3480 -s 3580
                          2⤵
                          • Program crash
                          PID:5104
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 596 -p 3480 -ip 3480
                        1⤵
                          PID:1696
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 588 -p 3676 -ip 3676
                          1⤵
                            PID:1712
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3024
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 3024 -s 6096
                                2⤵
                                • Program crash
                                PID:3228
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4008
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -pss -s 540 -p 3024 -ip 3024
                                1⤵
                                  PID:2148
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3960
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 3960 -s 7392
                                      2⤵
                                      • Program crash
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4568
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:2304
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:4576
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 4576 -s 3520
                                          2⤵
                                          • Program crash
                                          PID:4484
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -pss -s 184 -p 4576 -ip 4576
                                        1⤵
                                          PID:3560
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -pss -s 532 -p 3960 -ip 3960
                                          1⤵
                                            PID:1104
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:656
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -u -p 656 -s 5980
                                                2⤵
                                                • Program crash
                                                PID:3416
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4536
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 620 -p 656 -ip 656
                                                1⤵
                                                  PID:2944
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4616
                                                    • C:\Windows\system32\WerFault.exe
                                                      C:\Windows\system32\WerFault.exe -u -p 4616 -s 6364
                                                      2⤵
                                                      • Program crash
                                                      PID:1320
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4812
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:2044
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 2044 -s 3560
                                                          2⤵
                                                          • Program crash
                                                          PID:3424
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -pss -s 596 -p 2044 -ip 2044
                                                        1⤵
                                                          PID:3392
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -pss -s 548 -p 4616 -ip 4616
                                                          1⤵
                                                            PID:3220
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3684
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -u -p 3684 -s 6092
                                                                2⤵
                                                                • Program crash
                                                                PID:3692
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4796
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -pss -s 624 -p 3684 -ip 3684
                                                                1⤵
                                                                  PID:3624
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:5020
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 5020 -s 7720
                                                                      2⤵
                                                                      • Program crash
                                                                      PID:4840
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3040
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:2200
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -u -p 2200 -s 3584
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:228
                                                                      • C:\Windows\system32\WerFault.exe
                                                                        C:\Windows\system32\WerFault.exe -pss -s 384 -p 2200 -ip 2200
                                                                        1⤵
                                                                          PID:2308
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -pss -s 600 -p 5020 -ip 5020
                                                                          1⤵
                                                                            PID:3364
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2304
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -u -p 2304 -s 6096
                                                                                2⤵
                                                                                • Program crash
                                                                                PID:1104
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:1332
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -pss -s 572 -p 2304 -ip 2304
                                                                                1⤵
                                                                                  PID:4132
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4828
                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                      C:\Windows\system32\WerFault.exe -u -p 4828 -s 1908
                                                                                      2⤵
                                                                                      • Program crash
                                                                                      PID:3324
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2400
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:4176
                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                          C:\Windows\system32\WerFault.exe -u -p 4176 -s 2884
                                                                                          2⤵
                                                                                          • Program crash
                                                                                          PID:1768
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -pss -s 544 -p 4176 -ip 4176
                                                                                        1⤵
                                                                                          PID:1684
                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                          C:\Windows\system32\WerFault.exe -pss -s 544 -p 4828 -ip 4828
                                                                                          1⤵
                                                                                            PID:3024
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:660
                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                C:\Windows\system32\WerFault.exe -u -p 660 -s 7496
                                                                                                2⤵
                                                                                                • Program crash
                                                                                                PID:1604
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1436
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3776
                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                    C:\Windows\system32\WerFault.exe -u -p 3776 -s 3616
                                                                                                    2⤵
                                                                                                    • Program crash
                                                                                                    PID:8
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 608 -p 3776 -ip 3776
                                                                                                  1⤵
                                                                                                    PID:4316
                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 568 -p 660 -ip 660
                                                                                                    1⤵
                                                                                                      PID:4416
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:1596
                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1596 -s 7724
                                                                                                          2⤵
                                                                                                          • Program crash
                                                                                                          PID:2392
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:2596
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:320
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -u -p 320 -s 3540
                                                                                                              2⤵
                                                                                                              • Program crash
                                                                                                              PID:4908
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 416 -p 320 -ip 320
                                                                                                            1⤵
                                                                                                              PID:1224
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 420 -p 1596 -ip 1596
                                                                                                              1⤵
                                                                                                                PID:1712
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:2080
                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 2080 -s 6276
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:4148
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:1840
                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 472 -p 2080 -ip 2080
                                                                                                                    1⤵
                                                                                                                      PID:2200
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:2072
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 2072 -s 4124
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          PID:3340
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:3024
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:4536
                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 4536 -s 3556
                                                                                                                              2⤵
                                                                                                                              • Program crash
                                                                                                                              PID:2980
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 472 -p 4536 -ip 4536
                                                                                                                            1⤵
                                                                                                                              PID:3596
                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 508 -p 2072 -ip 2072
                                                                                                                              1⤵
                                                                                                                                PID:3808
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:672
                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 672 -s 7340
                                                                                                                                    2⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:2812
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:2016
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:2764
                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2764 -s 3600
                                                                                                                                        2⤵
                                                                                                                                        • Program crash
                                                                                                                                        PID:1048
                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 544 -p 2764 -ip 2764
                                                                                                                                      1⤵
                                                                                                                                        PID:2136
                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 508 -p 672 -ip 672
                                                                                                                                        1⤵
                                                                                                                                          PID:4228
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1804
                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 1804 -s 7404
                                                                                                                                              2⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:3700
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:3972
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:4244
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4244 -s 3576
                                                                                                                                                  2⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:3576
                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 560 -p 4244 -ip 4244
                                                                                                                                                1⤵
                                                                                                                                                  PID:2588
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 616 -p 1804 -ip 1804
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1336
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:5104
                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 5104 -s 7692
                                                                                                                                                        2⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:3460
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2844
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2112
                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 2112 -s 3560
                                                                                                                                                            2⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:4636
                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 600 -p 2112 -ip 2112
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3856
                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 532 -p 5104 -ip 5104
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4120
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3228
                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 3228 -s 5948
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:3968
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2200
                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 584 -p 3228 -ip 3228
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2812
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4976
                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 4976 -s 5988
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Program crash
                                                                                                                                                                        PID:2184
                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:3364
                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1800
                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 1800 -s 3548
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:3428
                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 472 -p 1800 -ip 1800
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:1744
                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 532 -p 4976 -ip 4976
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:1568
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              explorer.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:4100
                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4100 -s 6068
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Program crash
                                                                                                                                                                                  PID:2692
                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:2392
                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1576
                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 1576 -s 3528
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:940
                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 596 -p 1576 -ip 1576
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:3560
                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 604 -p 4100 -ip 4100
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4948
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4196
                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4196 -s 7584
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Program crash
                                                                                                                                                                                            PID:3656
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3764
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1028
                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 1028 -s 3620
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                PID:1684
                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 492 -p 1028 -ip 1028
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:1576
                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 548 -p 4196 -ip 4196
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2216
                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:928
                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 928 -s 6088
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                      PID:4132
                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2824
                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 552 -p 928 -ip 928
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4760 -s 5788
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3124
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2044 -s 3584
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 552 -p 2044 -ip 2044
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4132
                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 424 -p 4760 -ip 4760
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2120
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 3008 -s 5760
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3588
                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4932
                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 4932 -s 3584
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 656 -p 4932 -ip 4932
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 4828 -s 3932
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 472 -p 3008 -ip 3008
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3592
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:1496
                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 1496 -s 4584
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                  PID:2240
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3452
                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 620 -p 4828 -ip 4828
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3880
                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 548 -p 1496 -ip 1496
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1792
                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:3588
                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 3588 -s 5880
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:2260
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 3008 -s 3588
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                              PID:4604
                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 536 -p 3008 -ip 3008
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:3116
                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 548 -p 3588 -ip 3588
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:1888
                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 1888 -s 5928
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                    PID:2516
                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:3904
                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3904 -s 3532
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 424 -p 3904 -ip 3904
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4280
                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 688 -p 1888 -ip 1888
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:3228

                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          d9129f6f8ca9f84edbe3c643512e0de2

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          0b03f2c370941c97777657b15369b44d0d87926a

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          42c127d2791cbb50de26bcdb6eddeaa452caa7ca7a437b6de20d6e4888826f02

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          21f7580f80f399753165df3730c3bedb4d513e256eb8fdf0321d2ad45cb51af591a0be645374b5d97d57b8839dbee5fce4e96917f58b27c8dfc485557339c6aa

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          404B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          96313262185ba4d992f035bee48f2fae

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          51daa2e7af069065144d2721366be17f618a6f73

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          aa6cd2d8037283451ebd236dc79b55dcbd53a3f74d411a918e430c240f8818ee

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          7e8348c79d09bf8b2a21f6fec350a953fa67223ceda38a2b6e056af2deb4956889c42e12114d90b43b3ad951b77be15bb7bda5aa8075ccbd50fa7fe9795b1507

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GSP6GPKD\microsoft.windows[1].xml
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          fe944d229104fea0759b99572bfec403

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          70c6bf4e77dd02eacd2858d7f94487ff93b2489d

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          c25bf7a411aa32b9de9dbe0d00368a63a733699a36a7468471825de5459e4b29

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          ff0f95f1d17b4e91c86b3ebab8a620303c2d7429fc3072352994d04795a7ec5cc6d2ad378349e7ec8160625ca72345fbcd12d30ef8ad09c76b5792d92f4f68bc

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • memory/320-310-0x00000195D52A0000-0x00000195D52C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/320-313-0x00000195D58C0000-0x00000195D58E0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/320-307-0x00000195D52E0000-0x00000195D5300000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/660-279-0x0000000004700000-0x0000000004701000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/672-347-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1028-467-0x0000019E4B220000-0x0000019E4B240000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1028-471-0x0000019E4B680000-0x0000019E4B6A0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1028-469-0x0000019E4AFE0000-0x0000019E4B000000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1576-447-0x0000019B56360000-0x0000019B56380000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1576-449-0x0000019B56770000-0x0000019B56790000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1576-444-0x0000019B563A0000-0x0000019B563C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1596-300-0x0000000004010000-0x0000000004011000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1800-424-0x00000243933B0000-0x00000243933D0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1800-421-0x00000243933F0000-0x0000024393410000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1800-427-0x0000024393850000-0x0000024393870000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1804-369-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2044-220-0x00000163C5AB0000-0x00000163C5AD0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2044-222-0x00000163C60C0000-0x00000163C60E0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2044-496-0x000001D644310000-0x000001D644330000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2044-493-0x000001D643F00000-0x000001D643F20000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2044-491-0x000001D643F40000-0x000001D643F60000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2044-216-0x00000163C5AF0000-0x00000163C5B10000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2072-323-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2112-403-0x00000237808D0000-0x00000237808F0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2112-400-0x0000023780420000-0x0000023780440000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2112-397-0x0000023780460000-0x0000023780480000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2200-244-0x0000017D2F4A0000-0x0000017D2F4C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2200-240-0x0000017D2EED0000-0x0000017D2EEF0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2200-242-0x0000017D2EE90000-0x0000017D2EEB0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2764-354-0x000001CF803E0000-0x000001CF80400000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2764-357-0x000001CF803A0000-0x000001CF803C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2764-360-0x000001CF80B20000-0x000001CF80B40000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3084-142-0x0000000004690000-0x0000000004691000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3440-150-0x0000013529100000-0x0000013529120000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3440-148-0x0000013529140000-0x0000013529160000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3440-152-0x00000135295A0000-0x00000135295C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3480-170-0x000001CCCB680000-0x000001CCCB6A0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3480-168-0x000001CCCB6C0000-0x000001CCCB6E0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3480-172-0x000001CCCBCA0000-0x000001CCCBCC0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3676-160-0x0000000004050000-0x0000000004051000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3776-292-0x0000013B2F950000-0x0000013B2F970000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3776-289-0x0000013B2F540000-0x0000013B2F560000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3776-287-0x0000013B2F580000-0x0000013B2F5A0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3960-184-0x0000000004210000-0x0000000004211000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4100-437-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4176-268-0x000002551BEE0000-0x000002551BF00000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4176-266-0x000002551B8C0000-0x000002551B8E0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4176-264-0x000002551B900000-0x000002551B920000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4196-460-0x00000000029D0000-0x00000000029D1000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4244-380-0x0000019117D20000-0x0000019117D40000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4244-382-0x0000019118120000-0x0000019118140000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4244-377-0x0000019117D60000-0x0000019117D80000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4536-336-0x000002B4B5000000-0x000002B4B5020000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4536-331-0x000002B4B4BA0000-0x000002B4B4BC0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4536-334-0x000002B4B4B60000-0x000002B4B4B80000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4576-195-0x0000016FA25A0000-0x0000016FA25C0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4576-197-0x0000016FA2CB0000-0x0000016FA2CD0000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4576-192-0x0000016FA25E0000-0x0000016FA2600000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4616-208-0x0000000002E20000-0x0000000002E21000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4760-483-0x0000000003F70000-0x0000000003F71000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4828-257-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4976-413-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5020-232-0x0000000004200000-0x0000000004201000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5104-389-0x00000000040B0000-0x00000000040B1000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                          Download