Overview

overview

8

Static

static

3

520e5faf4d...bb.exe

windows7-x64

8

520e5faf4d...bb.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    26s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2023 14:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    520e5faf4d8fd41e7b5cf82581b4600468f90b7fe1960fb3ee5d9b92707f24bb.exe

  • Size

    3.2MB

  • MD5

    401beba06a5442c4744b371604da7ef4

  • SHA1

    5abd8463db8a08e7db5da5ee79f87f155bc05f61

  • SHA256

    520e5faf4d8fd41e7b5cf82581b4600468f90b7fe1960fb3ee5d9b92707f24bb

  • SHA512

    1d61450e3bdc07779ec6364d8967671890cd2c6169a0f1f5733f3782f98afc826620d47a4c2b2e1c719b88ae53f7032c13578ccd2926e05899342ee008852914

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlQIXhDgNjkpxHRegkL1:c+8X9G3vP3AMS83pcL

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\520e5faf4d8fd41e7b5cf82581b4600468f90b7fe1960fb3ee5d9b92707f24bb.exe
    "C:\Users\Admin\AppData\Local\Temp\520e5faf4d8fd41e7b5cf82581b4600468f90b7fe1960fb3ee5d9b92707f24bb.exe"
    1⤵
      PID:4676
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:516
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3352
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:1644
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3296
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3356
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3000
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4964
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of SendNotifyMessage
            PID:3180
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3612
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1384
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            PID:4896
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4964
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              PID:4648
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:224
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:1516
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4916
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1432
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4696
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4108
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3632
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:2760
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:228
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4416
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4964
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4424
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4916
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1704
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:2204
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1028
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:428
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4876
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:1944
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:804
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2148
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4416
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3628
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4444
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3536
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2240
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3188
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2216
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:2744
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:1700
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:5064
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:516
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4984
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:1904
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3228
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3160
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:5028
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4056
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:1692
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:2996
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3764
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3880
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3740
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:4592
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:1600
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:4532
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:3228
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:3680
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:3800
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:2640
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:3456
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4980
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:2144
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:676
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:1428
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:3476
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:4884
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:3560
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:2192
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:3264
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:4868
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:3500
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:2144
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:2996
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:4104
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:4044
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4756

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                  Filesize

                                                                                                                                                  471B

                                                                                                                                                  MD5

                                                                                                                                                  f0340f4241a4fe86605b7642a6e93971

                                                                                                                                                  SHA1

                                                                                                                                                  47edc3521e36ae56a87be18ed5fa2c719a922f46

                                                                                                                                                  SHA256

                                                                                                                                                  adfbb80ee9aca34a3e52ea230efe165c3536987bb0f9cd69f84cae9101327173

                                                                                                                                                  SHA512

                                                                                                                                                  4aa02a3aed09ffafac4ad545438c66ea696c32ea54fabcf14bd006d8c3ca41c55c7021b910cf15564bbc074f6291f48a74b2fde5577795277299db3bed8a8d54

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                  Filesize

                                                                                                                                                  412B

                                                                                                                                                  MD5

                                                                                                                                                  5ac55f4ffea697d6640fe956f6c5ef0f

                                                                                                                                                  SHA1

                                                                                                                                                  da41e248279f562c69852fac106d52ef4ec5a5f0

                                                                                                                                                  SHA256

                                                                                                                                                  da22fc59def41ea87bbf327759ff1e69e3fb2b426fd7974c7510b711f6f73dbc

                                                                                                                                                  SHA512

                                                                                                                                                  51bb2cdb194424d6d7e654bb7b4e8bcd2f5cc6d75409b452332b93ab1d0e34c9cd1bc68e674982c146fc0b30ba8d78160224ceacaf1069f6185f0a2edb7eed0d

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                  SHA1

                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                  SHA256

                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                  SHA512

                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                  Download Submit

                                                                                                                                                • memory/676-358-0x00000000032F0000-0x00000000032F1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1028-137-0x000001B687CB0000-0x000001B687CD0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1028-141-0x000001B688080000-0x000001B6880A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1028-139-0x000001B687C70000-0x000001B687C90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1384-40-0x0000023C7D690000-0x0000023C7D6B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1384-38-0x0000023C7D6D0000-0x0000023C7D6F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1384-43-0x0000023C7DCA0000-0x0000023C7DCC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1516-65-0x00000245A94E0000-0x00000245A9500000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1516-64-0x00000245A8DD0000-0x00000245A8DF0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1516-62-0x00000245A9120000-0x00000245A9140000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1600-300-0x000001D666280000-0x000001D6662A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1600-296-0x000001D665CA0000-0x000001D665CC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1600-298-0x000001D665C60000-0x000001D665C80000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1700-224-0x0000027C1E500000-0x0000027C1E520000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1700-227-0x0000027C1E4C0000-0x0000027C1E4E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1700-231-0x0000027C1EAE0000-0x0000027C1EB00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1704-129-0x0000000004810000-0x0000000004811000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/1944-153-0x00000000033A0000-0x00000000033A1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2148-161-0x000001EB068F0000-0x000001EB06910000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2148-163-0x000001EB068B0000-0x000001EB068D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2148-165-0x000001EB06EC0000-0x000001EB06EE0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2216-217-0x0000000003E60000-0x0000000003E61000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2760-83-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2996-272-0x000002389B9A0000-0x000002389B9C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2996-277-0x000002389BD70000-0x000002389BD90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2996-274-0x000002389B960000-0x000002389B980000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3180-30-0x0000000004350000-0x0000000004351000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3188-201-0x00000151B1780000-0x00000151B17A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3188-203-0x00000151B1740000-0x00000151B1760000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3188-206-0x00000151B1B50000-0x00000151B1B70000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3228-241-0x00000000041B0000-0x00000000041B1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3356-9-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3456-346-0x00000183C7CE0000-0x00000183C7D00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3456-342-0x00000183C7700000-0x00000183C7720000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3456-344-0x00000183C76C0000-0x00000183C76E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3476-366-0x000001C45AB40000-0x000001C45AB60000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3536-194-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3632-81-0x0000015D0C9F0000-0x0000015D0C9F8000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  32KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3680-321-0x000001EE18E70000-0x000001EE18E90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3680-319-0x000001EE18EB0000-0x000001EE18ED0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3680-323-0x000001EE19480000-0x000001EE194A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3740-288-0x0000000004830000-0x0000000004831000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/3800-334-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4056-264-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4416-93-0x000001E24CB20000-0x000001E24CB40000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4416-91-0x000001E24CB60000-0x000001E24CB80000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4416-96-0x000001E24CF30000-0x000001E24CF50000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4416-173-0x0000000004990000-0x0000000004991000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4444-186-0x0000012CE0300000-0x0000012CE0320000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4444-181-0x0000012CDFCE0000-0x0000012CDFD00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4444-183-0x0000012CDFCA0000-0x0000012CDFCC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4532-311-0x00000000041F0000-0x00000000041F1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4648-54-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4696-78-0x0000000004210000-0x0000000004211000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4916-114-0x000002543A9D0000-0x000002543A9F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4916-118-0x000002543ADA0000-0x000002543ADC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4916-116-0x000002543A990000-0x000002543A9B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4964-20-0x00000263BAB50000-0x00000263BAB70000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4964-18-0x00000263BA740000-0x00000263BA760000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4964-106-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4964-15-0x00000263BA780000-0x00000263BA7A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5028-251-0x0000025D59800000-0x0000025D59820000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5028-249-0x0000025D59840000-0x0000025D59860000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download

                                                                                                                                                • memory/5028-254-0x0000025D59C10000-0x0000025D59C30000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  Download