ae7d127c7e1804f6e0777b47d773f80165529d6e2cbbecce0328f5ef952406d5

Resubmissions

18/08/2026, 08:46

260818-kpgysagn5t

18/08/2026, 08:44

260818-knn1psgn4x10

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Прайс радіостанції.xls
Size 1010KB
Sample260818-knn1psgn4x
SHA256 ae7d127c7e1804f6e0777b47d773f80165529d6e2cbbecce0328f5ef952406d5
MD5 b162bc83106d6851378ca36b005e04d8
SHA1 e1aa93f2f4d6cc6dcf637b47601e7539651f5388
SHA512 8f3c7299d7c8ab9c1150b9d035f3fb67d14d0dd3837df752b1805acbab04fb31a54ddb8553f8b334dabad81c595e4d77654186bd2ebe63d9e96108384cbd3f26
SSDEEP 12288:z29Ww1zzMMpLykj5oAln0ZFlgUKhfTiIUj/O4P7hV:qswtMMpx5fFCmZTOO4P7hV
TLSH
T1A3252A4DA15CC82BE69FAC314D0695DABA787C073F5DB1877050739A3E7F9A0DA4E280
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion macro macro_on_action persistence privilege_escalation ransomware

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1064	1296	taskkill.exe	84
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4040	1296	explorer.exe	84

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

pid	Process
1296	EXCEL.EXE

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 1 IoCs

pid	Process
4040	explorer.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x000a000000024412-308.dat	office_macro_on_action

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/4040-339-0x0000000001570000-0x000000000157A000-memory.dmp	ConfuserEx

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1064	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - es-ES Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\MSTTSLocitIT.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{0a556d98-cfee-4d84-82a7-00377f939198}\InProcServer32\ = "%appdata%\\Microsoft\\Windows\\PowerShell\\PSReadLine\\PSReadLineCore.dll"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Elsa"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Japanese Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Female"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft David - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR fr-FR Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5248260"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Elsa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat.prev"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\lsr1036.lxa"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\lsr1033.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Paul"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134231915005094604"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{C6FABB24-E332-46FB-BC91-FF331B2D51F0}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{E164F996-FF93-4675-BDD8-6C47AB0B86B1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - fr-FR Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR fr-FR Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Vous avez sélectionné %1 comme voix par défaut."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Haruka"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "409;9"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{31350404-77AC-4471-B33A-9020A2EDA1D1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\MSTTSLocjaJP.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_HW_ja-JP.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lts Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 ^ 0008 1 0009 2 000a ~ 000b : 000c a 000d aw 000e ax 000f ay 0010 b 0011 d 0012 ch 0013 eh 0014 eu 0015 ey 0016 f 0017 g 0018 h 0019 ih 001a iy 001b jh 001c k 001d l 001e m 001f n 0020 ng 0021 oe 0022 oh 0023 ow 0024 oy 0025 p 0026 pf 0027 r 0028 s 0029 sh 002a t 002b ts 002c ue 002d uh 002e uw 002f uy 0030 v 0031 x 0032 y 0033 z 0034 zh 0035"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Zira - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Laura"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; message=NativeSupported; computer=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR Engine (11.0) Text Normalization"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\MSTTSLocenUS.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\MSTTSLocesES.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "11.0.2016.0129"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40A;C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Anywhere;Trailing"	SearchApp.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\~Прайс радіостанції.xls.tmp\:Zone.Identifier:$DATA	EXCEL.EXE
File created	C:\Users\Admin\AppData\Local\Temp\2D095E00\:Zone.Identifier:$DATA	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1296	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeDebugPrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeShutdownPrivilege	4040	explorer.exe
Token: SeCreatePagefilePrivilege	4040	explorer.exe
Token: SeIncreaseQuotaPrivilege	4040	explorer.exe
Token: SeSecurityPrivilege	4040	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1296	EXCEL.EXE
1296	EXCEL.EXE
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1296	EXCEL.EXE
1480	StartMenuExperienceHost.exe
4040	explorer.exe
4752	SearchApp.exe
4040	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1064	1296	EXCEL.EXE	94
PID 1296 wrote to memory of 4040	1296	EXCEL.EXE	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Прайс радіостанції.xls"
1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /IM explorer.exe
  2⤵
  - Process spawned unexpected child process
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Process spawned unexpected child process
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4040

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1480

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 1KB
SHA256 c09fe489895574cb02acf7a3daeb917236bec9bf0666fe062a3c45e4cafac92c
MD5 69bb12171d7903213e4af4ec677bdb05
SHA1 0e9c20fdf98af283d0f398cdf425c1146f1981ee
SHA512 2cb1f821e434a1d526ae45fe81c13cae023a9f30082a80b7919952e24c4699e50b9980e1c48b7f489bb0c5dd611b48b46049daecb1504cad9dd71aa8cb551f35
TLSH
T199310913433C26513D98F54464858A033C7AA9C1DCD48C07980C92312D65BE6BB6494C
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 7202757591eeeab608f65f3b1b5d1dee24df5d2f19fb210cdd67f6c75b9ffcc7
MD5 8f60c53505caf3bdb0a65b0fc7f7fd03
SHA1 5f5d973bb09a1f0f83a75b88e594e83c149fa6e7
SHA512 2bcf96ee6bf34ca19b4545e8d18579216a1130079d5e907200a56c546c22ad5294a9e6857957de8b2058095e7e0c67772fd34d8d324b34db453e73a19f50172e
TLSH
T177F0D45111ECE4817D5BC0CC22F8063A7C1050A62ABE064820BC89F109566BDFD1F07E
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 426B
SHA256 dc8ff2af8ad5bf0d0b81cb884529cc2373c44190563f4e95730537f4c0d93be7
MD5 ad052be6b4b44dde782f24bd0193c946
SHA1 1e0781686cdb50193480e9ed23a6e018537ec3da
SHA512 90ed5ce56170d5ac60dcbb28e46c2cd103ec45f57b0102be34c27f299511ad40e012793a77829f63288c37ce0df1d8dca795d7f46f0072709072320209bebdf2
TLSH
T197E0D85469FE5428E372AE7C1BD9557F563EF26B0C04676D3720512C2645D540C36B32
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 17a70f7ed8ab16c9b5d9a08d94d3a02e0ee4da33d9478e03c6d0ed5cb93475c2
MD5 da5b1c4220c2b6d32075d0486abcfe9e
SHA1 d88ace29a1f004db2b8f247e2aa6c9490314fa34
SHA512 8ac3846f2e70c4efa17bec63b0501b7b9e58b387f5796d9e65dff1cf97dcf89ab252bdc5f34b28ecd0bf404adb5aa17232c5575422c849117d20efe4c78b0b2c
TLSH
T15EE0C01419FB821DF4F5C13807CA7660955AF0160944F3BA3BF42709E703A00DC13D34
MD5 SHA1 SHA512 TLSH

Submit Download

AppCache134315163680564578.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134315163680564578.txt
Size 85KB
SHA256 958a0d3157b898d26e83f21a7d3d463c859b30ec1668737474e8638006af8c57
MD5 a4f82e2657c62d062f872c4a56aa963c
SHA1 6ac8d5b02801fac5e11cb283627e07975dc9674e
SHA512 b9f49cd4e1bd5ff81f5488845679dd14661fcba6466707a6161a50321a77c92b43a2ade2ffaa35b1186fb56510f07890f5f7f14aa6f08c3eca97c2861e6f298c
SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/i8:vYGzozpnodR3V1D
TLSH
T17F83A2A53281CBF3317966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Size 30KB
SHA256 e743847527ce198145cdff5b6242cc9b0aa8e1d0af55375d6a2ab505819e6321
MD5 d6522859859a37987ba91aab064e5fd4
SHA1 59a9a40e8a1c2528c6b2e0bf53ebfdba6c10080b
SHA512 4500d4d9f2037abf2e641f49b6b65b7a5cde5189f45ee0473832931d2d6e174bb766c00ba12818126b6afbaaf7249520b08a16ddee6d401a13960b66a140e050
SSDEEP 384:ev0oeuyRGwPNyQ62JP39ceW+i3+aXqaINfcFpJYxWwlzMaefQOVjeQ8RJoT:eYuyRG4P39cj+i3+aXqaINfclY2l8RJs
TLSH
T167D20A342AF51725F3F28F758AF59AAA683B7862AD10DB9D0162034D0537E53C970F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ziadi3ss.jqd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ziadi3ss.jqd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Прайс радіостанції.xls

Path C:\Users\Admin\AppData\Local\Temp\Прайс радіостанції.xls
Size 1010KB
SHA256 84e65197286425d93ff0baf3bdeaba43beb5de988da27ff7caa85e5b7e36f19f
MD5 4fbf143ea09b0a4a9f35d257e1b1e1b3
SHA1 51f31c77402fc8fe906699a9e23aaa6fb7be5f46
SHA512 e58bb170095e71d1fe995ec331248527dd2778ef6609a0fce2d2ae71e9744f931e40da3d4a600ac8e3308249ad825139b97020bb5634008f0d11dec4793c8843
SSDEEP 12288:7a9Ww1zz4MpLWkj5o4lz0ZFdgUKhjTi3XDtxtCESU:Wswt4Mpd535CONTCtxtCbU
TLSH
T17A252A4DA15CC82BE69FAC314D4592DABA787C077F5DB2873050739A3E7F9A0DA4E240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\Cache\icon.png
Size 208KB
SHA256 ef456a425b6ced72c7703feca36cd88ab535df2792da79319c7c1d2c63f02bf9
MD5 44fbacf20204f96f3637b294fd15710a
SHA1 34cd3e5ac9e3439d278a16583563623266e1230f
SHA512 1e9dbad8738c243fff92d088fd5f2c7e4e1fd118799965519eef2522803d8036a7b79ec3f4812fdff105e022ffe9ffcaead3ae2317270d0b258758413247e2d4
SSDEEP 6144:CoPi3QlGg9OKuXsXTpiTW/bjobelzhIVc:CodlGg8KxsT2Dv
TLSH
T1182422C40208440D395FAD94EF491BDA80CF6834B773905EE4A17D578E84ABBEFEC659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSReadLineCore.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\PSReadLineCore.dll
Size 292KB
SHA256 70a0e2940e0be141b4d6e2a6989e8baf08279e162a7915354b6874bf297972d3
MD5 2a7870390b13d32a883a0bc8369464c4
SHA1 75eb4984f759faa299a0c88fed8dabcc07729426
SHA512 488541ba458c6c41a337acd51603e0ab069ca93ef6b4eac2af2a6c42f9e1bd84a66c445c7236ba4a31d545715ae75a4091e8ace35db06c75181a4c4663c1df2a
SSDEEP 6144:ehLARpWE1bFvzNtMTlemzjxojpoh/iRsu+SHIQyXWf:8gpWIFvznMRX1ojpo+9
TLSH
T1F8548D5973A54CB9E5A7C23CC8031A06E7FA78610F70DBAF03E08B5B2E17790952E756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 a50496a12a1271732b13af30d09bf92d18a9e238fc9d49019dc716896c2ead9a
MD5 992d1cd7753b2856ef0aed3b9c67b5f1
SHA1 a8c42be0c331be20b5bcbec917a2d9c99b4a7b09
SHA512 aca5300b99829a5e068c43ac42c1903f8683cbdf0c44acb87012dd55e89d6f02b6374349a1681767db1fff8b256b1124ac21b72ca0f2721e5d31c2a0d1235d7e
TLSH
T1BF5141014AD71FABD074C230573A8713EB603D42ABD5AA4E97C8A14E6E758008B2DE6B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1296-50-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-327-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-6-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-5-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-22-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-29-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-30-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-31-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-40-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-49-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-51-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-0-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-58-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-64-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-63-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-46-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-66-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-67-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-68-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-69-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-70-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-77-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-78-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-79-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-7-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-91-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-93-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-94-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-13-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-12-0x00007FFE26F70000-0x00007FFE26F80000-memory.dmp

Download

memory/1296-3-0x00007FFE694ED000-0x00007FFE694EE000-memory.dmp

Download

memory/1296-14-0x00007FFE26F70000-0x00007FFE26F80000-memory.dmp

Download

memory/1296-10-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-11-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-8-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-4-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-326-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-325-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-324-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-323-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-2-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-302-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-1-0x00007FFE294D0000-0x00007FFE294E0000-memory.dmp

Download

memory/1296-272-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/1296-9-0x00007FFE69450000-0x00007FFE69645000-memory.dmp

Download

memory/4040-340-0x0000000003050000-0x0000000003056000-memory.dmp

Download

memory/4040-98-0x0000000005910000-0x000000000592A000-memory.dmp

Download

memory/4040-225-0x0000000026F00000-0x0000000026FAA000-memory.dmp

Download

memory/4040-226-0x0000000026470000-0x0000000026482000-memory.dmp

Download

memory/4040-227-0x0000000026E50000-0x0000000026E82000-memory.dmp

Download

memory/4040-290-0x0000000023760000-0x0000000023772000-memory.dmp

Download

memory/4040-291-0x00000000237C0000-0x00000000237FC000-memory.dmp

Download

memory/4040-224-0x0000000027380000-0x00000000278A8000-memory.dmp

Download

memory/4040-361-0x0000000023BA0000-0x0000000023BC4000-memory.dmp

Download

memory/4040-360-0x0000000023BA0000-0x0000000023BCA000-memory.dmp

Download

memory/4040-359-0x0000000004500000-0x000000000450A000-memory.dmp

Download

memory/4040-358-0x0000000024840000-0x00000000248F5000-memory.dmp

Download

memory/4040-106-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/4040-99-0x0000000020CB0000-0x0000000020E72000-memory.dmp

Download

memory/4040-330-0x00000000015D0000-0x00000000015EA000-memory.dmp

Download

memory/4040-331-0x0000000001590000-0x00000000015B0000-memory.dmp

Download

memory/4040-229-0x0000000027070000-0x0000000027122000-memory.dmp

Download

memory/4040-333-0x0000000021FB0000-0x0000000021FCE000-memory.dmp

Download

memory/4040-332-0x0000000022490000-0x00000000224C2000-memory.dmp

Download

memory/4040-335-0x0000000024280000-0x000000002438A000-memory.dmp

Download

memory/4040-336-0x0000000022510000-0x000000002254A000-memory.dmp

Download

memory/4040-337-0x0000000022680000-0x00000000226AA000-memory.dmp

Download

memory/4040-338-0x0000000001580000-0x000000000158C000-memory.dmp

Download

memory/4040-339-0x0000000001570000-0x000000000157A000-memory.dmp

Download

memory/4040-228-0x0000000026E90000-0x0000000026EE0000-memory.dmp

Download

memory/4040-334-0x0000000022450000-0x000000002246A000-memory.dmp

Download

memory/4040-348-0x00000000224D0000-0x00000000224F2000-memory.dmp

Download

memory/4040-349-0x00000000034A0000-0x00000000034C6000-memory.dmp

Download

memory/4040-357-0x00000000234F0000-0x000000002350C000-memory.dmp

Download

memory/4752-108-0x000002B6CC920000-0x000002B6CCA20000-memory.dmp

Download

memory/4752-112-0x000002B6CD940000-0x000002B6CD960000-memory.dmp

Download

memory/4752-124-0x000002B6CD900000-0x000002B6CD920000-memory.dmp

Download

memory/4752-143-0x000002B6CDD00000-0x000002B6CDD20000-memory.dmp

Download