Overview

overview

8

Static

static

3

e21540352d...JC.exe

windows7-x64

8

e21540352d...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2023, 16:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e21540352d8efa00d20e1273327959ed_mafia_JC.exe

  • Size

    1.6MB

  • MD5

    e21540352d8efa00d20e1273327959ed

  • SHA1

    099b5cb3ce92821299b74da5e78a292ba5b9b377

  • SHA256

    e4e4b7f63288baa2d05693c163e07de992566e6c556b50cf7e065b3eea97cfac

  • SHA512

    18e6b247c3c1da7b73d96ce2c344a818fe6ea27d3c5f861171606c0e920218c14fe91adca784cb1ff42ea66c68809c8c4c735e4dd8b147ff44aea2bc9d1cb5a9

  • SSDEEP

    49152:ESiUxnr/rmkAmcwiuT5r5R/TI3ANkTTle:E4xnr/rmkZZ63AMY

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 49 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e21540352d8efa00d20e1273327959ed_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\e21540352d8efa00d20e1273327959ed_mafia_JC.exe"
    1⤵
      PID:4768
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3896
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 3896 -s 6172
        2⤵
        • Program crash
        PID:3536
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2940
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 452 -p 3896 -ip 3896
      1⤵
        PID:2848
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3556
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3556 -s 5864
          2⤵
          • Program crash
          PID:3280
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3100
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 420 -p 3556 -ip 3556
        1⤵
          PID:4036
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3748
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3748 -s 7460
            2⤵
            • Program crash
            PID:2964
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2272
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1864
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 1864 -s 4004
                2⤵
                • Program crash
                PID:3888
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 408 -p 1864 -ip 1864
              1⤵
                PID:2780
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 552 -p 3748 -ip 3748
                1⤵
                  PID:884
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of SendNotifyMessage
                  PID:4940
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 4940 -s 5944
                    2⤵
                    • Program crash
                    PID:4224
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:2252
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:2612
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 2612 -s 3164
                    2⤵
                    • Program crash
                    PID:4036
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 556 -p 2612 -ip 2612
                  1⤵
                    PID:1352
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 184 -p 4940 -ip 4940
                    1⤵
                      PID:4504
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies registry class
                      PID:1404
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 1404 -s 5804
                        2⤵
                        • Program crash
                        PID:3936
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:2272
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:1260
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 1260 -s 3556
                        2⤵
                        • Program crash
                        PID:4988
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 548 -p 1260 -ip 1260
                      1⤵
                        PID:1868
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 432 -p 1404 -ip 1404
                        1⤵
                          PID:3656
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies registry class
                          PID:3840
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 3840 -s 6024
                            2⤵
                            • Program crash
                            PID:1952
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:964
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 472 -p 3840 -ip 3840
                          1⤵
                            PID:4652
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:2556
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 2556 -s 7340
                                2⤵
                                • Program crash
                                PID:3848
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4528
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3560
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -u -p 3560 -s 3616
                                    2⤵
                                    • Program crash
                                    PID:4024
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -pss -s 560 -p 3560 -ip 3560
                                  1⤵
                                    PID:4316
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -pss -s 412 -p 2556 -ip 2556
                                    1⤵
                                      PID:3164
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1716
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 1716 -s 3484
                                          2⤵
                                          • Program crash
                                          PID:4800
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1428
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4460
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 4460 -s 3604
                                              2⤵
                                              • Program crash
                                              PID:1104
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -pss -s 444 -p 4460 -ip 4460
                                            1⤵
                                              PID:5116
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -pss -s 444 -p 1716 -ip 1716
                                              1⤵
                                                PID:432
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3580
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 3580 -s 6012
                                                    2⤵
                                                    • Program crash
                                                    PID:3688
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4864
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3520
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -u -p 3520 -s 3512
                                                        2⤵
                                                        • Program crash
                                                        PID:4824
                                                    • C:\Windows\system32\WerFault.exe
                                                      C:\Windows\system32\WerFault.exe -pss -s 500 -p 3520 -ip 3520
                                                      1⤵
                                                        PID:4124
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -pss -s 432 -p 3580 -ip 3580
                                                        1⤵
                                                          PID:432
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3212
                                                            • C:\Windows\system32\WerFault.exe
                                                              C:\Windows\system32\WerFault.exe -u -p 3212 -s 5764
                                                              2⤵
                                                              • Program crash
                                                              PID:2324
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:3684
                                                            • C:\Windows\system32\WerFault.exe
                                                              C:\Windows\system32\WerFault.exe -pss -s 408 -p 3212 -ip 3212
                                                              1⤵
                                                                PID:4532
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2940
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -u -p 2940 -s 7208
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:5016
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3100
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:4484
                                                                      • C:\Windows\system32\WerFault.exe
                                                                        C:\Windows\system32\WerFault.exe -u -p 4484 -s 3604
                                                                        2⤵
                                                                        • Program crash
                                                                        PID:3872
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -pss -s 508 -p 4484 -ip 4484
                                                                      1⤵
                                                                        PID:4832
                                                                      • C:\Windows\system32\WerFault.exe
                                                                        C:\Windows\system32\WerFault.exe -pss -s 420 -p 2940 -ip 2940
                                                                        1⤵
                                                                          PID:4668
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:208
                                                                            • C:\Windows\system32\WerFault.exe
                                                                              C:\Windows\system32\WerFault.exe -u -p 208 -s 6148
                                                                              2⤵
                                                                              • Program crash
                                                                              PID:2044
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:1724
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2072
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 2072 -s 3564
                                                                                  2⤵
                                                                                  • Program crash
                                                                                  PID:3688
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -pss -s 444 -p 2072 -ip 2072
                                                                                1⤵
                                                                                  PID:4384
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -pss -s 384 -p 208 -ip 208
                                                                                  1⤵
                                                                                    PID:3412
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:4712
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -u -p 4712 -s 7420
                                                                                        2⤵
                                                                                        • Program crash
                                                                                        PID:3512
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:2704
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2096
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -u -p 2096 -s 3520
                                                                                            2⤵
                                                                                            • Program crash
                                                                                            PID:2620
                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                          C:\Windows\system32\WerFault.exe -pss -s 560 -p 2096 -ip 2096
                                                                                          1⤵
                                                                                            PID:1928
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -pss -s 572 -p 4712 -ip 4712
                                                                                            1⤵
                                                                                              PID:4104
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:5092
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -u -p 5092 -s 5752
                                                                                                  2⤵
                                                                                                  • Program crash
                                                                                                  PID:3792
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:4948
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 560 -p 5092 -ip 5092
                                                                                                  1⤵
                                                                                                    PID:3928
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3336
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3336 -s 7504
                                                                                                        2⤵
                                                                                                        • Program crash
                                                                                                        PID:4072
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:1156
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:3412
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -u -p 3412 -s 3560
                                                                                                            2⤵
                                                                                                            • Program crash
                                                                                                            PID:3916
                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 548 -p 3412 -ip 3412
                                                                                                          1⤵
                                                                                                            PID:2192
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 384 -p 3336 -ip 3336
                                                                                                            1⤵
                                                                                                              PID:920
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4884
                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4884 -s 7404
                                                                                                                  2⤵
                                                                                                                  • Program crash
                                                                                                                  PID:2736
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:460
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:1792
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 1792 -s 3560
                                                                                                                      2⤵
                                                                                                                      • Program crash
                                                                                                                      PID:3628
                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 384 -p 1792 -ip 1792
                                                                                                                    1⤵
                                                                                                                      PID:1460
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 500 -p 4884 -ip 4884
                                                                                                                      1⤵
                                                                                                                        PID:3412
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:4020
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4020 -s 7404
                                                                                                                            2⤵
                                                                                                                            • Program crash
                                                                                                                            PID:816
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:3004
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:3736
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 3736 -s 3504
                                                                                                                                2⤵
                                                                                                                                • Program crash
                                                                                                                                PID:1352
                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 412 -p 3736 -ip 3736
                                                                                                                              1⤵
                                                                                                                                PID:1196
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 576 -p 4020 -ip 4020
                                                                                                                                1⤵
                                                                                                                                  PID:872
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4300
                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 4300 -s 1296
                                                                                                                                      2⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:3856
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:2736
                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 560 -p 4300 -ip 4300
                                                                                                                                      1⤵
                                                                                                                                        PID:1816
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:856
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 856 -s 4792
                                                                                                                                            2⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:4392
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                          1⤵
                                                                                                                                          • Modifies Installed Components in the registry
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                          • Modifies registry class
                                                                                                                                          PID:2556
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:3008
                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 3008 -s 3580
                                                                                                                                              2⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:3248
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 404 -p 3008 -ip 3008
                                                                                                                                            1⤵
                                                                                                                                              PID:3604
                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 552 -p 856 -ip 856
                                                                                                                                              1⤵
                                                                                                                                                PID:4012
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4152
                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 4152 -s 6076
                                                                                                                                                    2⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:4532
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1040
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3936
                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3936 -s 3572
                                                                                                                                                        2⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:3604
                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 588 -p 3936 -ip 3936
                                                                                                                                                      1⤵
                                                                                                                                                        PID:924
                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 576 -p 4152 -ip 4152
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2224
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1536
                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 1536 -s 6088
                                                                                                                                                              2⤵
                                                                                                                                                              • Program crash
                                                                                                                                                              PID:3916
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3180
                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 408 -p 1536 -ip 1536
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2092
                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                explorer.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:816
                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 816 -s 7296
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Program crash
                                                                                                                                                                    PID:3864
                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2496
                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2224
                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 2224 -s 3604
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Program crash
                                                                                                                                                                        PID:4852
                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 500 -p 2224 -ip 2224
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5092
                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 604 -p 816 -ip 816
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4904
                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                          explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4460
                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 4460 -s 7392
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Program crash
                                                                                                                                                                              PID:3576
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:8
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2876
                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 2876 -s 3552
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Program crash
                                                                                                                                                                                  PID:2268
                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 552 -p 2876 -ip 2876
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3884
                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 384 -p 4460 -ip 4460
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1776
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4796
                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 4796 -s 5480
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Program crash
                                                                                                                                                                                        PID:3328
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1676
                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 408 -p 4796 -ip 4796
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:3384
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3348
                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 3348 -s 7360
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Program crash
                                                                                                                                                                                              PID:2224
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1104
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4852 -s 2364
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:392
                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 528 -p 4852 -ip 4852
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 612 -p 3348 -ip 3348
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4652
                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 4652 -s 7376
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3580
                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 3580 -s 3924
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                          PID:452
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5088
                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 596 -p 3580 -ip 3580
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3856
                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 588 -p 4652 -ip 4652
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3692
                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 3692 -s 5896
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:3580
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:1568
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 4288 -s 3392
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:1272
                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 612 -p 4288 -ip 4288
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 604 -p 3692 -ip 3692
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:436
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3204
                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 3204 -s 5936
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 596 -p 3204 -ip 3204
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4008
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:740
                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 740 -s 5768
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3700
                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 3700 -s 3564
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:3260
                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 652 -p 3700 -ip 3700
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:2384
                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 632 -p 740 -ip 740
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4344
                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4872

                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          471B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          95b5644bd8502f5427e239448ba4b7c6

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f2feb2ecb28e1f58c0c93a79d271415faf75d13a

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          113a4acbbcc8f5439407a10b5a443fbe4f075243db76b9b53932c688d3f69c8e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a5cccc73ea9208bd77f7abc8dd74510172728de69e55c502a9648a10b4c0f0012ab3faf473d3ef8cfaa51bbeb3ebfe0a5ccee60872fcab4bd11b71e557ccb595

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          412B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          40e8b21a8f5655a0c09011a71b2fbfb3

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          0e681ff7675ed931c68adf0f6383e8b314c6846e

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          730fa2f79058997eeb2e2428a98ae407158c256556f89fccd2657d3141b1f6f6

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d1e187b8411771d553db6e229fddd63aae600afb20db1316f75277e688ab30164cf0c60622e5291650b10d3e501409106d598708930913a6c925af0004f5c82c

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\S331LB7M\microsoft.windows[1].xml
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          97B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          402e0c5b12db3a5ffb0bece9995d459b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f0138de23eb90c99efb1d0b1bd0dac8f1e7102a2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6272b42676075c969ca60882f74e3c1711a3b6db824c9bb9b7f5b412e2131bc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5caea684bcc1aa6b3ade82c94fbab992c65f3b543a999f1435c683ec785eab784e86940545cdc35641401f1ead5d28dddf5ccb34156a054c36b566fc8cbbe8f2

                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                        • memory/208-170-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/816-325-0x0000000004020000-0x0000000004021000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/856-278-0x0000000004640000-0x0000000004641000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1260-66-0x0000028A14410000-0x0000028A14430000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1260-63-0x0000028A14000000-0x0000028A14020000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1260-61-0x0000028A14040000-0x0000028A14060000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1404-53-0x0000000003F70000-0x0000000003F71000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1716-100-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1792-252-0x000001D00E610000-0x000001D00E630000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1792-248-0x000001D00E200000-0x000001D00E220000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1792-245-0x000001D00E240000-0x000001D00E260000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1864-19-0x000002ACA8770000-0x000002ACA8790000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1864-15-0x000002ACA83A0000-0x000002ACA83C0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/1864-16-0x000002ACA8360000-0x000002ACA8380000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2072-182-0x000002AE2FCE0000-0x000002AE2FD00000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2072-178-0x000002AE2F920000-0x000002AE2F940000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2072-180-0x000002AE2F5D0000-0x000002AE2F5F0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2096-201-0x000001D046300000-0x000001D046320000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2096-204-0x000001D0462C0000-0x000001D0462E0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2096-206-0x000001D0468E0000-0x000001D046900000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2224-333-0x0000019486AE0000-0x0000019486B00000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2224-336-0x0000019486AA0000-0x0000019486AC0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2224-340-0x00000194870C0000-0x00000194870E0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2556-77-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2612-38-0x0000020146C00000-0x0000020146C20000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2612-42-0x0000020146FD0000-0x0000020146FF0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2612-40-0x00000201469C0000-0x00000201469E0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2876-356-0x0000019869160000-0x0000019869180000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2876-361-0x0000019869530000-0x0000019869550000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2876-358-0x0000019869120000-0x0000019869140000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/2940-147-0x0000000003640000-0x0000000003641000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3008-289-0x000002A561B00000-0x000002A561B20000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3008-286-0x000002A561B40000-0x000002A561B60000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3008-291-0x000002A561F00000-0x000002A561F20000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3336-217-0x0000000004630000-0x0000000004631000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3412-230-0x000001AC18F60000-0x000001AC18F80000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3412-227-0x000001AC18B50000-0x000001AC18B70000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3412-225-0x000001AC18B90000-0x000001AC18BB0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3520-134-0x00000253DC820000-0x00000253DC840000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3520-137-0x00000253DCC30000-0x00000253DCC50000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3520-131-0x00000253DC860000-0x00000253DC880000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3560-89-0x00000186E0A90000-0x00000186E0AB0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3560-87-0x00000186E0680000-0x00000186E06A0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3560-85-0x00000186E06C0000-0x00000186E06E0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3580-123-0x00000000022F0000-0x00000000022F1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3736-265-0x000002556BCC0000-0x000002556BCE0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3736-271-0x000002556C2A0000-0x000002556C2C0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3736-268-0x000002556BC80000-0x000002556BCA0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3748-8-0x0000000003050000-0x0000000003051000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3936-309-0x00000212ED240000-0x00000212ED260000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3936-311-0x00000212ED200000-0x00000212ED220000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/3936-313-0x00000212ED600000-0x00000212ED620000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4020-257-0x0000000002E80000-0x0000000002E81000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4152-301-0x00000000043C0000-0x00000000043C1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4460-108-0x000002C05D7E0000-0x000002C05D800000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4460-111-0x000002C05D7A0000-0x000002C05D7C0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4460-113-0x000002C05DBB0000-0x000002C05DBD0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4460-348-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4484-155-0x0000022C16980000-0x0000022C169A0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4484-160-0x0000022C16D50000-0x0000022C16D70000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4484-157-0x0000022C16940000-0x0000022C16960000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4712-193-0x00000000028D0000-0x00000000028D1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4884-237-0x0000000003090000-0x0000000003091000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                        • memory/4940-31-0x0000000004470000-0x0000000004471000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download