Overview

overview

8

Static

static

3

5054c9a21d...05.exe

windows7-x64

8

5054c9a21d...05.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2023 14:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5054c9a21d942f8470989a895ffb30521f61f7258a8292bad9a6f11ecd920a05.exe

  • Size

    2.6MB

  • MD5

    33f34df67c4bc0f8652834e9b5c2729c

  • SHA1

    87efd475922268cbebfb77f5673522153b9e6fd3

  • SHA256

    5054c9a21d942f8470989a895ffb30521f61f7258a8292bad9a6f11ecd920a05

  • SHA512

    df811869715af3203cbba586e016c5cf0d5b092588d1a7f6b34287ddb091fdc2c6f1d515edba9e4225d9a6517417d70bf6974c81ae3f82a03897931e0102a00b

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlSUJLR:c+8X9G3vP3AMdVR

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\5054c9a21d942f8470989a895ffb30521f61f7258a8292bad9a6f11ecd920a05.exe
    "C:\Users\Admin\AppData\Local\Temp\5054c9a21d942f8470989a895ffb30521f61f7258a8292bad9a6f11ecd920a05.exe"
    1⤵
      PID:1224
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4308
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4992
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:664
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3272
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      PID:1460
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1344
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4680
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4356
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4540
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3204
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4316
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4196
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4068
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:1240
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:4756
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4992
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4848
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2784
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2072
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1228
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3952
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4948
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1844
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3948
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:2408
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4580
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:5000
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4008
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4856
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3832
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:908
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3132
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2132
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2504
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3624
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4012
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:2208
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:792
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4780
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:2140
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3836
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1924
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4692
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3624
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3600
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3960
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:368
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:4580
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:3256
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4872
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:324
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:640
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3928
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:4752
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2932
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3784
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1424
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:5072
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:3332
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3420
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:2820
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4580
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4944
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4780
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3412
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3756
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:3616

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                              Filesize

                                                                                                              471B

                                                                                                              MD5

                                                                                                              f0340f4241a4fe86605b7642a6e93971

                                                                                                              SHA1

                                                                                                              47edc3521e36ae56a87be18ed5fa2c719a922f46

                                                                                                              SHA256

                                                                                                              adfbb80ee9aca34a3e52ea230efe165c3536987bb0f9cd69f84cae9101327173

                                                                                                              SHA512

                                                                                                              4aa02a3aed09ffafac4ad545438c66ea696c32ea54fabcf14bd006d8c3ca41c55c7021b910cf15564bbc074f6291f48a74b2fde5577795277299db3bed8a8d54

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                              Filesize

                                                                                                              412B

                                                                                                              MD5

                                                                                                              0ed8430e75b9d0ad094f502d4f7ae157

                                                                                                              SHA1

                                                                                                              c4c6ee671cfe5fdc44b73a1e60a4e2dc32877476

                                                                                                              SHA256

                                                                                                              6ed5ef7e207363ba47580c5a9c245378a12dc5e4b4c6e4ceda1aa93ba7628a36

                                                                                                              SHA512

                                                                                                              80845996685f2a33db6ac52b25601ecb0ae636a8a32ad118574acf47e9bc8dfd106e515445bcd16c12a83fcd3da0871debcfc87435626bd0c1d16569af6d2d0c

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133399528760247748.txt
                                                                                                              Filesize

                                                                                                              75KB

                                                                                                              MD5

                                                                                                              62d81c2e1e8b21733f95af2a596e4b18

                                                                                                              SHA1

                                                                                                              91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                                              SHA256

                                                                                                              a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                                              SHA512

                                                                                                              c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133399528760247748.txt
                                                                                                              Filesize

                                                                                                              75KB

                                                                                                              MD5

                                                                                                              62d81c2e1e8b21733f95af2a596e4b18

                                                                                                              SHA1

                                                                                                              91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                                              SHA256

                                                                                                              a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                                              SHA512

                                                                                                              c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PR67AA1Y\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              82b066a0c26e9c3c026d421e012a093e

                                                                                                              SHA1

                                                                                                              2e4493ff239034dd93befa48a286616fa1222526

                                                                                                              SHA256

                                                                                                              a4c381833e51949fd261b3e7bf72873bddc61d6eaf01a83a89beda5877338d64

                                                                                                              SHA512

                                                                                                              4fb425137bcab122288af0df6dd2774fb9179f9c178c8c7b738e6e293d8dbe0aff97a879f42670d07c5bbc69935104b8bdcef8fd7efaee48949dd354af626feb

                                                                                                              Download Submit

                                                                                                            • memory/368-284-0x0000011DB8930000-0x0000011DB8950000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/368-286-0x0000011DB8D40000-0x0000011DB8D60000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/368-282-0x0000011DB8970000-0x0000011DB8990000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/640-310-0x00000237E8FD0000-0x00000237E8FF0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/640-308-0x00000237E8BC0000-0x00000237E8BE0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/640-306-0x00000237E8C00000-0x00000237E8C20000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/792-216-0x000001B129180000-0x000001B1291A0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/792-220-0x000001B129590000-0x000001B1295B0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/792-213-0x000001B1291C0000-0x000001B1291E0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/1228-116-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/1240-82-0x00000147EB2C0000-0x00000147EB2E0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/1240-79-0x00000147EABB0000-0x00000147EABD0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/1240-77-0x00000147EAF00000-0x00000147EAF20000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/1344-24-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/1424-323-0x0000000004080000-0x0000000004081000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/1924-251-0x00000000044A0000-0x00000000044A1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/2132-186-0x00000000036B0000-0x00000000036B1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/2408-141-0x0000000004170000-0x0000000004171000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/3332-334-0x00000281D0DC0000-0x00000281D0DE0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3332-336-0x00000281D1510000-0x00000281D1530000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3332-331-0x00000281D1100000-0x00000281D1120000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3412-370-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/3600-274-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/3616-382-0x000002099ABA0000-0x000002099ABC0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3616-380-0x000002099A790000-0x000002099A7B0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3616-378-0x000002099A7D0000-0x000002099A7F0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3624-193-0x00000207054D0000-0x00000207054F0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3624-200-0x00000207058A0000-0x00000207058C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3624-195-0x0000020705490000-0x00000207054B0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3624-265-0x000001B387AC0000-0x000001B387AE0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3624-261-0x000001B3873B0000-0x000001B3873D0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3624-259-0x000001B387700000-0x000001B387720000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3832-171-0x000001FA25DD0000-0x000001FA25DF0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3832-169-0x000001FA26020000-0x000001FA26040000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3832-173-0x000001FA263E0000-0x000001FA26400000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3836-238-0x0000019B28050000-0x0000019B28070000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3836-240-0x0000019B28660000-0x0000019B28680000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3836-236-0x0000019B28090000-0x0000019B280B0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4008-161-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4012-206-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4196-69-0x0000000004D40000-0x0000000004D41000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4316-54-0x0000021A91320000-0x0000021A91340000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4316-56-0x0000021A90FD0000-0x0000021A90FF0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4316-58-0x0000021A916E0000-0x0000021A91700000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4356-31-0x000001D56E5E0000-0x000001D56E600000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4356-33-0x000001D56E5A0000-0x000001D56E5C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4356-35-0x000001D56E9B0000-0x000001D56E9D0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4540-46-0x0000000002570000-0x0000000002571000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4580-347-0x0000000002B90000-0x0000000002B91000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4756-92-0x0000000001780000-0x0000000001781000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4780-355-0x000001D78C8A0000-0x000001D78C8C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4780-228-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4780-359-0x000001D78CE80000-0x000001D78CEA0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4780-357-0x000001D78C860000-0x000001D78C880000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4848-106-0x00000232B4040000-0x00000232B4060000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4848-102-0x00000232B3C30000-0x00000232B3C50000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4848-100-0x00000232B3C70000-0x00000232B3C90000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4872-298-0x0000000004720000-0x0000000004721000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4948-128-0x0000027580120000-0x0000027580140000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4948-126-0x0000027DFFD20000-0x0000027DFFD40000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4948-124-0x0000027DFFD60000-0x0000027DFFD80000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/5000-149-0x00000205DE840000-0x00000205DE860000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/5000-153-0x00000205DE800000-0x00000205DE820000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/5000-156-0x00000205DEC10000-0x00000205DEC30000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download