Overview

overview

8

Static

static

3

2023-08-22...JC.exe

windows7-x64

8

2023-08-22...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    33s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2023, 16:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-22_3c369058aac331d77566226948246968_mafia_JC.exe

  • Size

    3.4MB

  • MD5

    3c369058aac331d77566226948246968

  • SHA1

    f50fe5f11fcf4ea344a26daec8958298ebf83eda

  • SHA256

    28ba6dbc17bbf8c008e374b1201146c8f47905880a0d71e3ecb3791f9112a199

  • SHA512

    7730af93555d093127f3968830d5c9044f8f90817d81189f2fbce9c6a24b1803ab6ddcfd0819fa7716d8e083240bff19f72b328717383ced1af5f7e4850402ed

  • SSDEEP

    49152:V9yiCJ5rFwnANZGEXep+9TxFegOSDAmosh3ANkTTlKiNGgKMXVwm3rfgZX9Yqm28:2J5rFwnApezgOS9V3AMk+GLvsrgbmh

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 48 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-22_3c369058aac331d77566226948246968_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-22_3c369058aac331d77566226948246968_mafia_JC.exe"
    1⤵
      PID:4884
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2196
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2196 -s 5820
        2⤵
        • Program crash
        PID:4700
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1040
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 444 -p 2196 -ip 2196
      1⤵
        PID:3604
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2660
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2660 -s 7424
          2⤵
          • Program crash
          PID:3284
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4052
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:260
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 260 -s 3928
          2⤵
          • Program crash
          PID:3344
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 520 -p 260 -ip 260
        1⤵
          PID:3244
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 568 -p 2660 -ip 2660
          1⤵
            PID:3976
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SendNotifyMessage
            PID:2980
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2980 -s 6028
              2⤵
              • Program crash
              PID:3800
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:3676
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 576 -p 2980 -ip 2980
            1⤵
              PID:1128
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious use of SendNotifyMessage
              PID:3632
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 3632 -s 6100
                2⤵
                • Program crash
                PID:4732
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:4324
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2708
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2708 -s 3604
                2⤵
                • Program crash
                PID:4288
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 584 -p 2708 -ip 2708
              1⤵
                PID:1448
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 532 -p 3632 -ip 3632
                1⤵
                  PID:396
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  PID:4880
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 4880 -s 6004
                    2⤵
                    • Program crash
                    PID:1976
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:1128
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 600 -p 4880 -ip 4880
                  1⤵
                    PID:3372
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    PID:732
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 732 -s 7592
                      2⤵
                      • Program crash
                      PID:2556
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:8
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:4712
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 4712 -s 3596
                      2⤵
                      • Program crash
                      PID:368
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 616 -p 4712 -ip 4712
                    1⤵
                      PID:3420
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 660 -p 732 -ip 732
                      1⤵
                        PID:848
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:1076
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 1076 -s 6020
                            2⤵
                            • Program crash
                            PID:3424
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3812
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -pss -s 680 -p 1076 -ip 1076
                            1⤵
                              PID:1276
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3388
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 3388 -s 7444
                                  2⤵
                                  • Program crash
                                  PID:2560
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4236
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4428
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 4428 -s 3540
                                      2⤵
                                      • Program crash
                                      PID:4516
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -pss -s 636 -p 4428 -ip 4428
                                    1⤵
                                      PID:3344
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -pss -s 672 -p 3388 -ip 3388
                                      1⤵
                                        PID:4000
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4160
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 4160 -s 4348
                                            2⤵
                                            • Program crash
                                            PID:3452
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1216
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4900
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -u -p 4900 -s 3484
                                                2⤵
                                                • Program crash
                                                PID:3944
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -pss -s 600 -p 4900 -ip 4900
                                              1⤵
                                                PID:4764
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 608 -p 4160 -ip 4160
                                                1⤵
                                                  PID:4004
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4912
                                                    • C:\Windows\system32\WerFault.exe
                                                      C:\Windows\system32\WerFault.exe -u -p 4912 -s 6936
                                                      2⤵
                                                      • Program crash
                                                      PID:1796
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3324
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1960
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 1960 -s 3532
                                                          2⤵
                                                          • Program crash
                                                          PID:1132
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -pss -s 608 -p 1960 -ip 1960
                                                        1⤵
                                                          PID:3608
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -pss -s 672 -p 4912 -ip 4912
                                                          1⤵
                                                            PID:3672
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:260
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -u -p 260 -s 6000
                                                                2⤵
                                                                • Program crash
                                                                PID:532
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4812
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -pss -s 620 -p 260 -ip 260
                                                                1⤵
                                                                  PID:3976
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:1304
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 1304 -s 3500
                                                                      2⤵
                                                                      • Program crash
                                                                      PID:1856
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:4236
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:2592
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -u -p 2592 -s 3556
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:3648
                                                                      • C:\Windows\system32\WerFault.exe
                                                                        C:\Windows\system32\WerFault.exe -pss -s 624 -p 2592 -ip 2592
                                                                        1⤵
                                                                          PID:3872
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -pss -s 680 -p 1304 -ip 1304
                                                                          1⤵
                                                                            PID:2196
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4516
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -u -p 4516 -s 7612
                                                                                2⤵
                                                                                • Program crash
                                                                                PID:4836
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                              • Modifies Installed Components in the registry
                                                                              • Enumerates connected drives
                                                                              • Checks SCSI registry key(s)
                                                                              • Modifies registry class
                                                                              PID:1076
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3936
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 3936 -s 3528
                                                                                  2⤵
                                                                                  • Program crash
                                                                                  PID:4912
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -pss -s 624 -p 3936 -ip 3936
                                                                                1⤵
                                                                                  PID:4460
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -pss -s 608 -p 4516 -ip 4516
                                                                                  1⤵
                                                                                    PID:4676
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3636
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -u -p 3636 -s 6008
                                                                                        2⤵
                                                                                        • Program crash
                                                                                        PID:4104
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:1040
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -pss -s 608 -p 3636 -ip 3636
                                                                                        1⤵
                                                                                          PID:3856
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:3012
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -u -p 3012 -s 5992
                                                                                              2⤵
                                                                                              • Program crash
                                                                                              PID:3832
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:4424
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:3652
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -u -p 3652 -s 3580
                                                                                                  2⤵
                                                                                                  • Program crash
                                                                                                  PID:1676
                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                C:\Windows\system32\WerFault.exe -pss -s 608 -p 3652 -ip 3652
                                                                                                1⤵
                                                                                                  PID:2656
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 596 -p 3012 -ip 3012
                                                                                                  1⤵
                                                                                                    PID:4248
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:212
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -u -p 212 -s 7468
                                                                                                        2⤵
                                                                                                        • Program crash
                                                                                                        PID:2980
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:1800
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:4428
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4428 -s 3612
                                                                                                            2⤵
                                                                                                            • Program crash
                                                                                                            PID:2748
                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 592 -p 4428 -ip 4428
                                                                                                          1⤵
                                                                                                            PID:2756
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 652 -p 212 -ip 212
                                                                                                            1⤵
                                                                                                              PID:4512
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4900
                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4900 -s 5932
                                                                                                                  2⤵
                                                                                                                  • Program crash
                                                                                                                  PID:3564
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:2652
                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 544 -p 4900 -ip 4900
                                                                                                                  1⤵
                                                                                                                    PID:4912
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:1764
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 1764 -s 3740
                                                                                                                        2⤵
                                                                                                                        • Program crash
                                                                                                                        PID:3864
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:4052
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:4924
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4924 -s 3604
                                                                                                                            2⤵
                                                                                                                            • Program crash
                                                                                                                            PID:3432
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 584 -p 4924 -ip 4924
                                                                                                                          1⤵
                                                                                                                            PID:4852
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 452 -p 1764 -ip 1764
                                                                                                                            1⤵
                                                                                                                              PID:4948
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:4164
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4164 -s 5976
                                                                                                                                  2⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:4544
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:3732
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 620 -p 4164 -ip 4164
                                                                                                                                  1⤵
                                                                                                                                    PID:1636
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:1736
                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 1736 -s 5860
                                                                                                                                        2⤵
                                                                                                                                        • Program crash
                                                                                                                                        PID:4144
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:3548
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:4100
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4100 -s 3620
                                                                                                                                            2⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:4984
                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 536 -p 4100 -ip 4100
                                                                                                                                          1⤵
                                                                                                                                            PID:3280
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 532 -p 1736 -ip 1736
                                                                                                                                            1⤵
                                                                                                                                              PID:4248
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:4700
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 4700 -s 6132
                                                                                                                                                  2⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:3960
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:2368
                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 544 -p 4700 -ip 4700
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1304
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3468
                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                        C:\Windows\system32\WerFault.exe -u -p 3468 -s 5892
                                                                                                                                                        2⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:1992
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4984
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4100
                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4100 -s 3552
                                                                                                                                                            2⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:3464
                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 548 -p 4100 -ip 4100
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2980
                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 484 -p 3468 -ip 3468
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1720
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2176
                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 2176 -s 3300
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:3740
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:260
                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4632
                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 4632 -s 3584
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:1324
                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 632 -p 4632 -ip 4632
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3024
                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 608 -p 2176 -ip 2176
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4996
                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                        explorer.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:2052
                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 2052 -s 3724
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:2700
                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2300
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3280
                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 3280 -s 3616
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Program crash
                                                                                                                                                                                PID:4624
                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 600 -p 3280 -ip 3280
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2656
                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 712 -p 2052 -ip 2052
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3024
                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1324
                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 1324 -s 7540
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:4588
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:3396
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1856
                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1856 -s 3548
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Program crash
                                                                                                                                                                                          PID:2892
                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 712 -p 1856 -ip 1856
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:3632
                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 728 -p 1324 -ip 1324
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2268
                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:2368
                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2368 -s 5924
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                PID:4892
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:3660
                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 548 -p 2368 -ip 2368
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4948
                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3496
                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 3496 -s 6108
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4504
                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 692 -p 3496 -ip 3496
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:620
                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 620 -s 4344
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                            PID:3188
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3880
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 4456 -s 3580
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                PID:4584
                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 708 -p 4456 -ip 4456
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:1748
                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 684 -p 620 -ip 620
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:3348
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 3676 -s 6108
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                      PID:2312
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 576 -p 3676 -ip 3676
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4024
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4232
                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 4232 -s 6024
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 676 -p 4232 -ip 4232
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:2748
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:64
                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 64 -s 3572
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:3896
                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 684 -p 64 -ip 64
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3108

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PKO26YQG\microsoft.windows[1].xml
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3dee3add8acc4023ea038e6e3e9a2ce9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8f3c4cc3d102e2d365f38c9e8af891f7accab420

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            18be1965ebf3d45d54059b2a7b009f8065ae1e511e17f85954a2508d1ee2d247

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6aae34d1ac73ff540031baf20ddf2ee9e84da02c5c1fa3c8547cd0ef14d7537e41f57c4e31b28f2e15e64a461f62a207473dd527c92ed23f9ee9731f679bea6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • memory/212-196-0x0000000003400000-0x0000000003401000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/260-14-0x000001DDD4660000-0x000001DDD4680000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/260-12-0x000001DDD4250000-0x000001DDD4270000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/260-9-0x000001DDD4290000-0x000001DDD42B0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/732-49-0x0000000004730000-0x0000000004731000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1304-133-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1324-338-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1736-242-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1764-218-0x00000000041E0000-0x00000000041E1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1856-351-0x000002B833F70000-0x000002B833F90000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1856-346-0x000002B833BA0000-0x000002B833BC0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1856-349-0x000002B833B60000-0x000002B833B80000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1960-125-0x0000016B907F0000-0x0000016B90810000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1960-122-0x0000016B901A0000-0x0000016B901C0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1960-119-0x0000016B901E0000-0x0000016B90200000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2052-315-0x0000000004680000-0x0000000004681000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2176-293-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2592-140-0x0000029390B70000-0x0000029390B90000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2592-143-0x0000029390B30000-0x0000029390B50000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2592-145-0x0000029390F40000-0x0000029390F60000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2660-2-0x00000000046B0000-0x00000000046B1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2708-33-0x0000021370400000-0x0000021370420000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2708-35-0x00000213701C0000-0x00000213701E0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2708-37-0x00000213707D0000-0x00000213707F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3012-177-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3280-323-0x0000024C8C0C0000-0x0000024C8C0E0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3280-325-0x0000024C8C080000-0x0000024C8C0A0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3280-328-0x0000024C8C490000-0x0000024C8C4B0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3388-73-0x0000000003F50000-0x0000000003F51000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3468-267-0x0000000004590000-0x0000000004591000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3632-25-0x0000000004560000-0x0000000004561000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3652-184-0x00000257143C0000-0x00000257143E0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3652-189-0x0000025714790000-0x00000257147B0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3652-186-0x0000025714380000-0x00000257143A0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3936-163-0x000001385C140000-0x000001385C160000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3936-165-0x000001385C100000-0x000001385C120000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3936-168-0x000001385C500000-0x000001385C520000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4100-279-0x000001E3AAE00000-0x000001E3AAE20000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4100-276-0x000001E3AAE40000-0x000001E3AAE60000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4100-250-0x0000025FA24A0000-0x0000025FA24C0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4100-252-0x0000025FA2460000-0x0000025FA2480000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4100-253-0x0000025FA2870000-0x0000025FA2890000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4100-281-0x000001E3AB200000-0x000001E3AB220000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4160-92-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4428-209-0x000001A8B7570000-0x000001A8B7590000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4428-87-0x0000028AF5FE0000-0x0000028AF6000000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4428-204-0x000001A8B71A0000-0x000001A8B71C0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4428-206-0x000001A8B7160000-0x000001A8B7180000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4428-81-0x0000028AF5C20000-0x0000028AF5C40000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4428-84-0x0000028AF59D0000-0x0000028AF59F0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4516-155-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4632-300-0x000002E577DC0000-0x000002E577DE0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4632-303-0x000002E578390000-0x000002E5783B0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4632-302-0x000002E577D80000-0x000002E577DA0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4712-57-0x000002B83C390000-0x000002B83C3B0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4712-59-0x000002B83C350000-0x000002B83C370000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4712-61-0x000002B83C760000-0x000002B83C780000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4900-103-0x000001911E960000-0x000001911E980000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4900-99-0x000001911E590000-0x000001911E5B0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4900-101-0x000001911E550000-0x000001911E570000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4912-111-0x0000000004F80000-0x0000000004F81000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4924-228-0x000002434B530000-0x000002434B550000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4924-230-0x000002434B940000-0x000002434B960000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4924-226-0x000002434B570000-0x000002434B590000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                            Download