Overview

overview

10

Static

static

10

XClient.exe

windows7-x64

10

XClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    738s
  • max time network
    899s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2024 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    194KB

  • MD5

    5acdf267c1c641f10c87797a26384cb3

  • SHA1

    bc338127279d63df363b3576c52655875a994f7c

  • SHA256

    585afc1a328b48eb4d21af829ecf1d006867c1e634e12fb93a284876c49822fd

  • SHA512

    29f9b97cca6ecb08443216105542fabdd607671f1aea8048042fa20d5dfa7f2c895f04ba45d5823863d987b9c0fc630c2713cafafb67351910819edc320f2060

  • SSDEEP

    3072:5aMRfNYn45BIJbUo+f5eO/fqxa3v7EsUT8rmtIhW:5Lf+n4cbFKq0/HUTftO

Score
10/10
stormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/YzbfPdbq

  • telegram

    https://api.telegram.org/bot7197152041:AAFBciIfecRKNs2FGtIwUCQpjjW4nxCmIQo/sendMessage?chat_id=7306315268

Signatures

  • Detect Xworm Payload 1 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 28 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 56 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 48 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:956
    • C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4652
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4532
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://exmple.com/
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff445f46f8,0x7fff445f4708,0x7fff445f4718
        3⤵
          PID:4356
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
          3⤵
            PID:4112
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3448
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
            3⤵
              PID:3228
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
              3⤵
                PID:3696
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
                3⤵
                  PID:2732
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
                  3⤵
                    PID:2288
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5036
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                    3⤵
                      PID:3320
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                      3⤵
                        PID:2280
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                        3⤵
                          PID:5252
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
                          3⤵
                            PID:5260
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14605207007049150252,8892610298971860787,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5188
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2996
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3544
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:380
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies registry class
                        PID:804
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Suspicious use of SendNotifyMessage
                        PID:3000
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4520
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of SendNotifyMessage
                        PID:4132
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1152
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:3132
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Modifies registry class
                        PID:1416
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:652
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:5096
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:3536
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4320
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:4160
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        PID:768
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4272
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:3252
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:4952
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1004
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:2104
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        PID:2716
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:3752
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:2776
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        PID:4176
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4660
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:4384
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:652
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4792
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:1176
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:3696
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:756
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:1064
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        PID:4300
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1192
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:2532
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        PID:3816
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:876
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:1580
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        PID:4304
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2224
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:552
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SetWindowsHookEx
                        PID:4556
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4012
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3076
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:3332
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:768
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:3076
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:5448
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            PID:5500
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4716
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Suspicious use of SetWindowsHookEx
                            PID:3368
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:4996
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2788
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:5176
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:6040
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:5624
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4912
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            PID:4412
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:6116
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Suspicious use of SetWindowsHookEx
                            PID:464
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:2132
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:684
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4872
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:2704
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:464
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Suspicious use of SetWindowsHookEx
                            PID:540
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            PID:3000
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:5620
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2424
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:8
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2016
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3976
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:6036
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:1268
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:624
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            PID:5436
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:740
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4684
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            PID:4584
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2364
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Suspicious use of SetWindowsHookEx
                            PID:2816
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:5412
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:5948
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:5852
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:180
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3332
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:5172
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1020
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2812
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4976
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:6036
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:5440
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4004
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1292
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3832
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:5868
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1860
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:5988
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3916
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:1060
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:2304
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:1576
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:5836
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:4764
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:4396
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:1176
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4532
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:5552
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:5972
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:652
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:4376
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1872
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:1904
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4264
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:624
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:2116
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:5704
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:2808
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:2796
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:6048
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:2028
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4684
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1948
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:4912
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:1936
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4760
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:4808
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:1324
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:5204
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:3124
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:2952
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:180
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:5716
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:1908
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1688
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:1512
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:2972
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:3332
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:4000
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:5480
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3956
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2632
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5604
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4876
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:5772
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2720
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3860
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:6104
                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2120
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4548
                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:6116
                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4532
                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                          explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5068
                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:1008
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3368
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:5512
                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5052
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:396
                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:652
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5580
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4044
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:2192
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5856
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4156
                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3600
                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5860
                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5940
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4220
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:5868
                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:5620
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5664
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:324
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:6116

                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Active Setup

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.014

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Active Setup

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.014

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                  Browser Information Discovery

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1217

                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                  6
                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                  6
                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    471B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    b9471aa2a3394e868b1396f59b010134

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    9fbeea257d78f9829b309da77aebc0c09f90e56b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    1f23c3ae7411cda111468bd4b0285c7e3eedf88500e0ea1b5d5011e4fc06d9aa

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    d28b48af50da4890c679a960da7ba93076ecdff0d19dc6ab9b64735a597931b49d04ee01cd298668950da7d30e37b0259f974b7bbe1a3de063f48cc021462198

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    412B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    b0ad4e4af6b61b2e204b0043ab78b03d

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    0483add9bce5a55e6b8ef9ae4afa7e5a501e1bd5

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    80c5170b31735a3dcadc701c6a5534fd019c7429ca7fbd797d9e177f128c28f1

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    92dff2983e9d2185e97ce7585bca62e8d160e34cad1abb48c2e943f71e8dacad8c973c6d6b0c99821be73d4701103f2112a9037f6789564aff1e5c6162bb72ee

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    443a627d539ca4eab732bad0cbe7332b

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    152B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    99afa4934d1e3c56bbce114b356e8a99

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    72B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    6ecbdfc34826410e2ce1e503f44b8d00

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    f1af4d4783af0bf54ebd29a84dfeaa0de05932f7

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    a79deb194733eee2d95fa138b48fadcf11ec30d140756f8a0c2d72ea43d1b613

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    494d4b70a340b89756eaef87f9cc928490a164806408ccd2cb2b428ceb1c10ceb5664e4c4e016129dd1c028c55dedcadad9f4a4b6a77c6cfc9493b313d528c79

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    185B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    efa3b79297b792ddfa72609e2389407a

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    7c959b0d9c508607119d7c112fe81939169c8ccb

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    04371cb7276a5868761433e311d805f97da580075fc9bf1a66f0a9d8ac9a4017

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    1f08b7ea9823ae979382586db83b05c0d0dc5cb565b3946fb8134c0dfaaf61fdf80d6c666ceca6522964ac446d2a2e798e1f0eaff3dd2ab5cae88a793db20eaf

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    c47aac546593b32c8ed8c2ee91af8373

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    1233be44ff97ec4b60841da825876deb699baed3

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    c6daa8a0548417bade235b0393fd57a2224e659f6366268e23847113a543bc26

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    c651066b5afbd2f193a8c3fa365ac5ff76ad2a4f345371fe1f7bd1911c7dc93c01105b76c4fac5bd37de1d0ec00e8d9849dc0d957d3d55474db685613b1eaf89

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    73064f4b787871b9c3abd5cb0331cd61

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    256e6e552e0bc234135d57e1a3369a1f4e6b9fad

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    d407c39cea6f44e6cdb36f0f527b5ee62b953573e85cb5d939404ad5236d87c6

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    9e098acf292f70c6eca994c328f511d7256378c842e071998f0577cf27c4790b841052a3b34a23c966dd9150d1ffd0385bd3250c9035c01a3810bdb8f247cd61

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    606110ba6b1ecc7ab975b3e1fc6ad10f

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    a8cda07d3ed89d8cd67eb5ba815550cce041a6b2

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    82a199d4c190bea10b97f01b8473e7f0089156f013264dee2800ccc4d2647710

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    351ebc3eb551b78f5e5f4467f1fe3c33f79c1a3184071c7167b52301be44e3fd4f010680eb549128702bf247c548f77be397327d9730b91e7e0557846819460c

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    6KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    af933cbcb2dfdea9ed6b88ee5dde67a5

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    9b40d26707f992e3967ac7ad776791c5edd8294f

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    e3c6a37bd10c2126dc6bb7a9de2b06ec1f1dfe88c8381e57e06a3a812ea89b01

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    3cc31d7b49735deae83c0d25dc7f5724adcc4c4802dd0f3bed7b1e3b82d8cfb99f7c696619b0b83d3d08687776648cff338c969579350e7d3e6915d6fc5e769d

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    16B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    16B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    206702161f94c5cd39fadd03f4014d98

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    11KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    83e0b8c3a8a5ed3079634fa3d6dfbf9c

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    da74bd21a7aec93b2dc44e3bf0aff80e82d9765b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    b73dd16ba7cd8d99e79808c4c24479cb7ecbd7283d989846322ceeabd42111a3

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    477b2e367dd99872032eec082b03063173fcc4545575d629ffbd5dbf4c526edc5463e99141546a737dafeb3e18ea2c5f8bc6220e29a1a9a9a1d5deabd8fb4c79

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    be8377ec0796e7feae958007c3ff3334

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ade85024c5559a109dfe52bd9e31e8369388f983

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    ffcf9aed285feefdb5a92799e175c2173146829d094ae79f045d884aaab6daad

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    ec94ca858b7dbbde708a08a1534e205ec6d03bed4036304ee7ff4b4ec9678b9b9ac4e825fbde775ad1c2d45c41738d75d48b02a503817d1658d7f1a033e6788e

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    62623d22bd9e037191765d5083ce16a3

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    4a07da6872672f715a4780513d95ed8ddeefd259

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    fd98baf5a9c30d41317663898985593b

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ea300b99f723d2429d75a6c40e0838bf60f17aad

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    aeceee3981c528bdc5e1c635b65d223d

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    de9939ed37edca6772f5cdd29f6a973b36b7d31b

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    b99f3c778a047e0348c92c16e0419fa29418d10d0fec61ad8283e92a094a2b32

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    df48285f38e9284efdbd9f8d99e2e94a46fb5465953421ab88497b73ae06895b98ea5c98796560810a6f342c31a9112ea87e03cd3e267fd8518d7585f492a8fb

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133796384037182852.txt
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    74KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    3805952a088eb49b70ef99f374905b13

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    ba6ce7d8c3b6829d5fc30f93fdcbd87ace026583

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    18dbea87512e5f02317a174f0491fe67917b3db36bb57a617bb19e0afd621c75

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    20db4a1efc7a819c7ea1da74b5d0434ca2efb476c3310dc29a329790ddaf54decc46ffc70a23d79be5e0adb93d238be78f25d50b3b34c8ed9582dcbeb2fbb796

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    670KB

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    9eb5f69e443e7d835e78519e5f3b3ef4

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    5ba40cd4a127359dbd006eb3b0f800809c138659

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    b14fd14a1ac0aa59e0b648b64af0fa4848a4601124fe8b37d0c3f7e4066908237eb1c9d01a43aa45444db104c68380a60e1e1625d1f4eda5d501a3c33206cf4f

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DGTT1KLJ\microsoft.windows[1].xml
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    97B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    dfc314c564e6dcc3d3d7f1d2cdf01ff5

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    53a06942171b8047e4850e459554488280da265e

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    56b9785b0255bd668bfdb7d6f789d1e54de550d567b85e52105893b8fbb45a08

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    48688def79fffd15cd97505f73860552d7ad5069cd741214ca13225dd69eff4111338175bcb6fc9e1ed926f4bbc11b28865ab3df33aabf8bb7b8b68a0531f5f5

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3l5kzie1.nht.ps1
                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                  • memory/652-1142-0x0000000004990000-0x0000000004991000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/768-563-0x0000000004530000-0x0000000004531000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1064-1309-0x000001B5E64C0000-0x000001B5E64E0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1064-1322-0x000001B5E6AE0000-0x000001B5E6B00000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1064-1296-0x000001B5E6500000-0x000001B5E6520000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1064-1293-0x000001B5E5600000-0x000001B5E5700000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1176-1149-0x0000024F89F10000-0x0000024F89F30000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1176-1180-0x0000024F8A4E0000-0x0000024F8A500000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1176-1169-0x0000024F89ED0000-0x0000024F89EF0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1416-258-0x0000000003F30000-0x0000000003F31000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1580-1583-0x0000021F63E00000-0x0000021F63F00000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1724-3-0x00007FFF30AC0000-0x00007FFF31581000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1724-4-0x00007FFF30AC0000-0x00007FFF31581000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1724-10-0x0000022E74240000-0x0000022E74262000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/1724-17-0x00007FFF30AC0000-0x00007FFF31581000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2104-704-0x00000211E8620000-0x00000211E8720000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2104-705-0x00000211E8620000-0x00000211E8720000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2104-709-0x00000211E9770000-0x00000211E9790000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2104-721-0x00000211E9730000-0x00000211E9750000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2104-735-0x00000211E9B40000-0x00000211E9B60000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2532-1443-0x000002F4DA700000-0x000002F4DA800000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2532-1458-0x000002F4DB820000-0x000002F4DB840000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2532-1446-0x000002F4DB860000-0x000002F4DB880000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2532-1442-0x000002F4DA700000-0x000002F4DA800000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2532-1478-0x000002F4DBC30000-0x000002F4DBC50000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2532-1441-0x000002F4DA700000-0x000002F4DA800000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2716-848-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2776-870-0x0000016A2B260000-0x0000016A2B280000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2776-850-0x0000016A2A340000-0x0000016A2A440000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2776-849-0x0000016A2A340000-0x0000016A2A440000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2776-854-0x0000016A2B2A0000-0x0000016A2B2C0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2776-886-0x0000016A2B880000-0x0000016A2B8A0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-98-0x0000000001160000-0x0000000001210000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    704KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-104-0x000000001B760000-0x000000001B76A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-100-0x0000000001210000-0x000000000121A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-99-0x000000001F210000-0x000000001F738000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    5.2MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-1438-0x000000001B780000-0x000000001B78A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-97-0x00000000010D0000-0x00000000010DC000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    48KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-101-0x0000000001220000-0x000000000122A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-102-0x000000001B630000-0x000000001B63A000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-103-0x000000001B640000-0x000000001B64C000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    48KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-0-0x00007FFF30AC3000-0x00007FFF30AC5000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-2144-0x000000001C000000-0x000000001C036000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-57-0x000000001E390000-0x000000001E4B0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-561-0x000000001B770000-0x000000001B77C000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    48KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-56-0x00007FFF30AC0000-0x00007FFF31581000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-2-0x00007FFF30AC0000-0x00007FFF31581000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    10.8MB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-1287-0x000000001B800000-0x000000001B812000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/2880-1-0x00000000008E0000-0x0000000000916000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3132-120-0x000002059E000000-0x000002059E100000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3132-119-0x000002059E000000-0x000002059E100000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3132-135-0x000002059F080000-0x000002059F0A0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3132-124-0x000002059F0C0000-0x000002059F0E0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3132-155-0x000002059F490000-0x000002059F4B0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3252-567-0x000001EFC6700000-0x000001EFC6800000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3252-570-0x000001EFC7800000-0x000001EFC7820000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3252-584-0x000001EFC77C0000-0x000001EFC77E0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3252-596-0x000001EFC7BD0000-0x000001EFC7BF0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3536-411-0x00000000028E0000-0x00000000028E1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3544-112-0x00000000035B0000-0x00000000035B1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3696-1290-0x00000000045B0000-0x00000000045B1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/3816-1582-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4132-117-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4160-412-0x0000016A24040000-0x0000016A24140000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4160-417-0x0000016A24FA0000-0x0000016A24FC0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4160-437-0x0000016A25570000-0x0000016A25590000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4160-427-0x0000016A24F60000-0x0000016A24F80000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4176-992-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4300-1440-0x00000000040E0000-0x00000000040E1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4384-1026-0x0000027585AC0000-0x0000027585AE0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4384-1012-0x00000275854A0000-0x00000275854C0000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4384-999-0x00000275854E0000-0x0000027585500000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4384-996-0x0000027584700000-0x0000027584800000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/4952-702-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5096-274-0x0000022B6D800000-0x0000022B6D820000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5096-260-0x0000022B6C700000-0x0000022B6C800000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5096-261-0x0000022B6C700000-0x0000022B6C800000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    1024KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5096-265-0x0000022B6D840000-0x0000022B6D860000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                  • memory/5096-297-0x0000022B6DC10000-0x0000022B6DC30000-memory.dmp

                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                    128KB

                                                                                                                                                                                                                    Download