Overview

overview

8

Static

static

3

NA_NA_25ea...JC.exe

windows7-x64

8

NA_NA_25ea...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    32s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2023, 18:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    NA_NA_25ea9386a5542eexeexe_JC.exe

  • Size

    4.0MB

  • MD5

    25ea9386a5542e5d8fe9a784bd53a188

  • SHA1

    80e79d1475ab9cca5a3c0b8bf4035d81d1addefe

  • SHA256

    806b6a032b93740f6dfe9ce8d2f34b87995bff19e0bfa13b03b96478b1547f5d

  • SHA512

    15355c3d7ba00853b5b5aeb112566478258de3918af483f189e0c7cc94257c56907c54985d8ff38a760406d0a35f5e687f21f987d29d4580621aa83adece9f8b

  • SSDEEP

    49152:L9yiCJ5rFwnANZGEXep+9TxFegOSDAmosh3ANkTTlrIA8orOwaHKFOpIfoAnCJ:UJ5rFwnApezgOS9V3AMx8NruMuo

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 49 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\NA_NA_25ea9386a5542eexeexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NA_NA_25ea9386a5542eexeexe_JC.exe"
    1⤵
      PID:4648
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2340
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2340 -s 6196
        2⤵
        • Program crash
        PID:2224
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2380
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 412 -p 2340 -ip 2340
      1⤵
        PID:3608
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4860
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 4860 -s 6044
          2⤵
          • Program crash
          PID:3272
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:5104
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 200 -p 4860 -ip 4860
          1⤵
            PID:3316
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3348
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3348 -s 5984
              2⤵
              • Program crash
              PID:632
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:1572
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3296
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3296 -s 4012
              2⤵
              • Program crash
              PID:1168
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 492 -p 3296 -ip 3296
            1⤵
              PID:220
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 548 -p 3348 -ip 3348
              1⤵
                PID:3232
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of SendNotifyMessage
                PID:3860
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 3860 -s 3480
                  2⤵
                  • Program crash
                  PID:1700
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:3776
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:1656
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 1656 -s 3592
                  2⤵
                  • Program crash
                  PID:972
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 540 -p 1656 -ip 1656
                1⤵
                  PID:576
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 444 -p 3860 -ip 3860
                  1⤵
                    PID:4656
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    PID:2740
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 2740 -s 7384
                      2⤵
                      • Program crash
                      PID:4676
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:548
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2564
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 2564 -s 3516
                        2⤵
                        • Program crash
                        PID:3672
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 444 -p 2564 -ip 2564
                      1⤵
                        PID:844
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 492 -p 2740 -ip 2740
                        1⤵
                          PID:4524
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies registry class
                          PID:4392
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 4392 -s 7376
                            2⤵
                            • Program crash
                            PID:2108
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1108
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:844
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 844 -s 3588
                                2⤵
                                • Program crash
                                PID:2968
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -pss -s 492 -p 844 -ip 844
                              1⤵
                                PID:1292
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -pss -s 572 -p 4392 -ip 4392
                                1⤵
                                  PID:3608
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3468
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 3468 -s 6020
                                      2⤵
                                      • Program crash
                                      PID:1948
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1536
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:1880
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 1880 -s 3564
                                          2⤵
                                          • Program crash
                                          PID:1156
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -pss -s 384 -p 1880 -ip 1880
                                        1⤵
                                          PID:632
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -pss -s 572 -p 3468 -ip 3468
                                          1⤵
                                            PID:4276
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:5060
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -u -p 5060 -s 4228
                                                2⤵
                                                • Program crash
                                                PID:2260
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4900
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:944
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 944 -s 3532
                                                    2⤵
                                                    • Program crash
                                                    PID:1292
                                                • C:\Windows\system32\WerFault.exe
                                                  C:\Windows\system32\WerFault.exe -pss -s 552 -p 944 -ip 944
                                                  1⤵
                                                    PID:3900
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -pss -s 536 -p 5060 -ip 5060
                                                    1⤵
                                                      PID:2152
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:1948
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 1948 -s 6032
                                                          2⤵
                                                          • Program crash
                                                          PID:4844
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:220
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -pss -s 384 -p 1948 -ip 1948
                                                          1⤵
                                                            PID:1108
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:180
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -u -p 180 -s 7300
                                                                2⤵
                                                                • Program crash
                                                                PID:952
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3436
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1592
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -u -p 1592 -s 3508
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:3800
                                                                • C:\Windows\system32\WerFault.exe
                                                                  C:\Windows\system32\WerFault.exe -pss -s 436 -p 1592 -ip 1592
                                                                  1⤵
                                                                    PID:1108
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -pss -s 200 -p 180 -ip 180
                                                                    1⤵
                                                                      PID:3128
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3300
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -u -p 3300 -s 7428
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:2176
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:4444
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:3268
                                                                            • C:\Windows\system32\WerFault.exe
                                                                              C:\Windows\system32\WerFault.exe -u -p 3268 -s 3592
                                                                              2⤵
                                                                              • Program crash
                                                                              PID:4120
                                                                          • C:\Windows\system32\WerFault.exe
                                                                            C:\Windows\system32\WerFault.exe -pss -s 556 -p 3268 -ip 3268
                                                                            1⤵
                                                                              PID:4688
                                                                            • C:\Windows\system32\WerFault.exe
                                                                              C:\Windows\system32\WerFault.exe -pss -s 444 -p 3300 -ip 3300
                                                                              1⤵
                                                                                PID:1864
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2328
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -u -p 2328 -s 6084
                                                                                    2⤵
                                                                                    • Program crash
                                                                                    PID:3628
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:220
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -pss -s 528 -p 2328 -ip 2328
                                                                                    1⤵
                                                                                      PID:3460
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:944
                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                          C:\Windows\system32\WerFault.exe -u -p 944 -s 3452
                                                                                          2⤵
                                                                                          • Program crash
                                                                                          PID:3460
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3600
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:1436
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -u -p 1436 -s 3508
                                                                                              2⤵
                                                                                              • Program crash
                                                                                              PID:4680
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -pss -s 532 -p 1436 -ip 1436
                                                                                            1⤵
                                                                                              PID:1168
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -pss -s 568 -p 944 -ip 944
                                                                                              1⤵
                                                                                                PID:972
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:576
                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                    C:\Windows\system32\WerFault.exe -u -p 576 -s 7436
                                                                                                    2⤵
                                                                                                    • Program crash
                                                                                                    PID:1436
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:2004
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:2652
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2652 -s 3624
                                                                                                        2⤵
                                                                                                        • Program crash
                                                                                                        PID:2100
                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 524 -p 2652 -ip 2652
                                                                                                      1⤵
                                                                                                        PID:956
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 540 -p 576 -ip 576
                                                                                                        1⤵
                                                                                                          PID:3892
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                          • Modifies Internet Explorer settings
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:2564
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -u -p 2564 -s 6260
                                                                                                            2⤵
                                                                                                            • Program crash
                                                                                                            PID:1292
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3708
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:2764
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2764 -s 3592
                                                                                                                2⤵
                                                                                                                • Program crash
                                                                                                                PID:3264
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 420 -p 2764 -ip 2764
                                                                                                              1⤵
                                                                                                                PID:3876
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 572 -p 2564 -ip 2564
                                                                                                                1⤵
                                                                                                                  PID:2692
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:2920
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 2920 -s 7500
                                                                                                                      2⤵
                                                                                                                      • Program crash
                                                                                                                      PID:3788
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:4160
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:496
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 496 -s 3592
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          PID:3872
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 568 -p 496 -ip 496
                                                                                                                        1⤵
                                                                                                                          PID:3924
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 444 -p 2920 -ip 2920
                                                                                                                          1⤵
                                                                                                                            PID:2440
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:3008
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 3008 -s 7336
                                                                                                                                2⤵
                                                                                                                                • Program crash
                                                                                                                                PID:2004
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:4240
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:1540
                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 1540 -s 3600
                                                                                                                                    2⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:5084
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 420 -p 1540 -ip 1540
                                                                                                                                  1⤵
                                                                                                                                    PID:1588
                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 640 -p 3008 -ip 3008
                                                                                                                                    1⤵
                                                                                                                                      PID:3872
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:748
                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 748 -s 7388
                                                                                                                                          2⤵
                                                                                                                                          • Program crash
                                                                                                                                          PID:1076
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:4048
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:3424
                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 3424 -s 3580
                                                                                                                                              2⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:3628
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 656 -p 3424 -ip 3424
                                                                                                                                            1⤵
                                                                                                                                              PID:2108
                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 444 -p 748 -ip 748
                                                                                                                                              1⤵
                                                                                                                                                PID:2224
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:2752
                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 2752 -s 7440
                                                                                                                                                    2⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:4964
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2068
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3808
                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3808 -s 3596
                                                                                                                                                        2⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:1236
                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 632 -p 3808 -ip 3808
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4928
                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 624 -p 2752 -ip 2752
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2472
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1540
                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 1540 -s 7400
                                                                                                                                                              2⤵
                                                                                                                                                              • Program crash
                                                                                                                                                              PID:3708
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2356
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3452
                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 3452 -s 3596
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:3248
                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 624 -p 3452 -ip 3452
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2436
                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 584 -p 1540 -ip 1540
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3952
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3712
                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3712 -s 7476
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Program crash
                                                                                                                                                                        PID:956
                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:632
                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:748
                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 748 -s 3548
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:3868
                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 592 -p 748 -ip 748
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3988
                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 600 -p 3712 -ip 3712
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:1476
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              explorer.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2152
                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 2152 -s 7432
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Program crash
                                                                                                                                                                                  PID:1208
                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1864
                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1440
                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 1440 -s 3608
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:736
                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 444 -p 1440 -ip 1440
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:2112
                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 560 -p 2152 -ip 2152
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1232
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:3428
                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 3428 -s 6112
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Program crash
                                                                                                                                                                                            PID:3392
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4004
                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 612 -p 3428 -ip 3428
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:748
                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:736
                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 736 -s 5864
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:1912
                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3272
                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2816
                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 2816 -s 3552
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                      PID:4408
                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 632 -p 2816 -ip 2816
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:3488
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3788
                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 3788 -s 3804
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 364 -p 736 -ip 736
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:1660
                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 4912 -s 5936
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                              PID:1476
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 552 -p 3788 -ip 3788
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3684
                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 564 -p 4912 -ip 4912
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:1692
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1888
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 1888 -s 5984
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:1292
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3172
                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 3844 -s 3544
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 548 -p 3844 -ip 3844
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:1576
                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 556 -p 1888 -ip 1888
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4232
                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2968 -s 6016
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                PID:4252
                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:3052
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 3488 -s 3548
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                    PID:2092
                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 584 -p 3488 -ip 3488
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 612 -p 2968 -ip 2968
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1572
                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:180
                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1200

                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                10d4ec863006c0ef2b502b96bf4f8517

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                6d7a58144a86a29f78a2843a8dc0a049a7f578c2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6e00d10571d8cb451281ea9aae376259a847ba7d6dd488977c2b0b6aaa0c7c6e

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                03b2813ba3ea7179ee360165d6d0320568936562ed51ff4fceabca1458871103bb63fe0a6603415c9c91f8146bc116b7dff4036a897d2210e358aeb15da6c49e

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                471B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                38b1c9baa58988c8ded6a099c969dfe3

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                c0281acc1c7d2f331139c601bb52da996a2e8ab5

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                813c84f64b711aa3a8c55cfa12fc8a73eba2eca4a299b357eafd158eadc34dc9

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                4bb4158d06782b861f1e2f492e2834057073820adc783a4e565cf072849c1deea4bebab79f7adcadba5466219c2c7d000565bb011e3205fd8f7812a6030d039d

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                404B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                602fa51aeb93e31a915bf798c1c8f073

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                b1f33aa0c4f6d5204b947f6fa7b0d3947982ac0c

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                0d32676ca3b7d58bc8c73396a3d147d054c61dcc76f9fb53bd7027fa6f38b2d9

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                dc3e0196aa54f64707d687da76f43aeb80da1c74279f4e55dae34772ed215f65c24920c3c800fa04dd1deec9651c96dfeb677e0e7e4148b3385fa98ffb63134c

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                412B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                ed75e6b27c7aa5cec0a87e9f39b1d307

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                9a0e0039062a3e263d7049b2c961acd2e3bfa984

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                fcd35fd6e2f339fb005ca05327e02dd3bb79b52f666fb5d20f112c74b0596f82

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                0dccb92ccb7616fe8ad0cc964ca86ecdb83a5727b0e876a8714e442dc59247beaa639ff9a7f89cdc98703a185bd1c8cea09366c2d1ec6e787bbf78391ac68189

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                              • memory/180-281-0x0000000004460000-0x0000000004461000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/496-399-0x0000020250620000-0x0000020250640000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/496-401-0x0000020250A30000-0x0000020250A50000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/496-397-0x0000020250660000-0x0000020250680000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/576-346-0x0000000004100000-0x0000000004101000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/748-435-0x00000000040D0000-0x00000000040D1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/844-223-0x0000014B858A0000-0x0000014B858C0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/844-221-0x0000014B85490000-0x0000014B854B0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/844-219-0x0000014B854D0000-0x0000014B854F0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/944-326-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/944-265-0x000001DB6B040000-0x000001DB6B060000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/944-268-0x000001DB6B000000-0x000001DB6B020000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/944-272-0x000001DB6B410000-0x000001DB6B430000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1436-336-0x000002CDD5290000-0x000002CDD52B0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1436-339-0x000002CDD56A0000-0x000002CDD56C0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1436-334-0x000002CDD52D0000-0x000002CDD52F0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1540-422-0x000001A729180000-0x000001A7291A0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1540-478-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1540-420-0x000001A7291C0000-0x000001A7291E0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1540-425-0x000001A729590000-0x000001A7295B0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1592-295-0x0000016DA2140000-0x0000016DA2160000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1592-292-0x0000016DA1D30000-0x0000016DA1D50000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1592-289-0x0000016DA1D70000-0x0000016DA1D90000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1656-176-0x00000148BB1D0000-0x00000148BB1F0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1656-178-0x00000148BB190000-0x00000148BB1B0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1656-181-0x00000148BB5A0000-0x00000148BB5C0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1880-244-0x00000207BA670000-0x00000207BA690000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1880-247-0x00000207BAA80000-0x00000207BAAA0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/1880-242-0x00000207BA6B0000-0x00000207BA6D0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2564-366-0x0000000003240000-0x0000000003241000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2564-199-0x000001C996450000-0x000001C996470000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2564-196-0x000001C996490000-0x000001C9964B0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2564-202-0x000001C996860000-0x000001C996880000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2652-358-0x000002847AAC0000-0x000002847AAE0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2652-356-0x000002847A6B0000-0x000002847A6D0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2652-354-0x000002847A6F0000-0x000002847A710000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2740-188-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2752-459-0x0000000004340000-0x0000000004341000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2764-378-0x0000023535100000-0x0000023535120000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2764-376-0x0000023534D00000-0x0000023534D20000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2764-374-0x0000023534D40000-0x0000023534D60000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/2920-389-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3008-413-0x0000000004120000-0x0000000004121000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3268-314-0x000002B96A610000-0x000002B96A630000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3268-309-0x000002B96A240000-0x000002B96A260000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3268-310-0x000002B96A200000-0x000002B96A220000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3296-157-0x00000166A1FB0000-0x00000166A1FD0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3296-153-0x00000166A19E0000-0x00000166A1A00000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3296-155-0x00000166A19A0000-0x00000166A19C0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3300-301-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3348-146-0x00000000033C0000-0x00000000033C1000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3424-443-0x000001D5AB680000-0x000001D5AB6A0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3424-445-0x000001D5AB640000-0x000001D5AB660000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3424-447-0x000001D5ABA50000-0x000001D5ABA70000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3452-486-0x000002477B5A0000-0x000002477B5C0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3452-492-0x000002477B970000-0x000002477B990000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3452-489-0x000002477B560000-0x000002477B580000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3468-234-0x0000000003180000-0x0000000003181000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3808-468-0x000002C67B090000-0x000002C67B0B0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3808-470-0x000002C67B6A0000-0x000002C67B6C0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3808-466-0x000002C67B0D0000-0x000002C67B0F0000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/3860-168-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/4392-211-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                              • memory/5060-258-0x0000000004890000-0x0000000004891000-memory.dmp

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                Download