Overview

overview

8

Static

static

3

fb2b77ffc6...23.exe

windows7-x64

8

fb2b77ffc6...23.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    18s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-10-2023 14:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fb2b77ffc6d8cc0b3320de8bc4e7a54fa4cec3cb682b6a541021ef43fa286723.exe

  • Size

    3.3MB

  • MD5

    5b672dd9a5e20006f046c1b0d65bbfd5

  • SHA1

    e65c9f5bba79ae00becf96d48f3489ddd89213f4

  • SHA256

    fb2b77ffc6d8cc0b3320de8bc4e7a54fa4cec3cb682b6a541021ef43fa286723

  • SHA512

    df895bafe4fe15bdce73e072d5cc81d44ab688ea6ffe0ce020a1961a484cd8e6548cb6b7ded0a1b74e1805d87742e3051bedc5a0e4a336a5dc807baa91b62eaa

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTl2FiVXTDivCH5WPXItT5I:c+8X9G3vP3AMoYVDuvfvItT5I

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb2b77ffc6d8cc0b3320de8bc4e7a54fa4cec3cb682b6a541021ef43fa286723.exe
    "C:\Users\Admin\AppData\Local\Temp\fb2b77ffc6d8cc0b3320de8bc4e7a54fa4cec3cb682b6a541021ef43fa286723.exe"
    1⤵
      PID:4964
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2348
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4660
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4748
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3652
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2040
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:640
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:5092
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:4408
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4056
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:2164
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3452
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4860
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3976
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4276
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1280
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3596
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:5092
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3224
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2376
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4520
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:2236
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:1344
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4356
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4596
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4340
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1620
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:1280
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:1216
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4560
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4188
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3520
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:2128
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:2184
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3560
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:4160
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:1916
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3928
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3812
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2128
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3796
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:872
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4972
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:772
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3396
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2092
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3332
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1224
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:1948
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4672
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:2568
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:3320
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:4608
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:1772
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1308
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:1368
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3416
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:3796
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:4252
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2348
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:4436
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:3972
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:1344
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:4160
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:964
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:380
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:2636
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:1832
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:4564
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1528
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:3352
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:3056
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:3496
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:1568
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:4072
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:4812
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:1788
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4776
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:704
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:180
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:184
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:776
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:964
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2072
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2336
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3412

                                                                                                                                                                Network

                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                  Filesize

                                                                                                                                                                  471B

                                                                                                                                                                  MD5

                                                                                                                                                                  6ddb1d9f924c0dff7f8df6a073bc8eaa

                                                                                                                                                                  SHA1

                                                                                                                                                                  8b35715938ca3c18a2e368ea035508d9ac0f7a1a

                                                                                                                                                                  SHA256

                                                                                                                                                                  ecac725e28fa74e59ae3a1327c8dec9d01d53818e4261d9f22145e7f0b06f3b0

                                                                                                                                                                  SHA512

                                                                                                                                                                  f09b130b3feeff4faa1ef47e94ca8228bca5e09b34b44c546982765858657becbf54b485b9fb8f48d4d57cecece2bae078fef2d6d4b5af92f0b1277d71e06475

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                  Filesize

                                                                                                                                                                  412B

                                                                                                                                                                  MD5

                                                                                                                                                                  9aa27649aa6f965127665c5afea8bc4c

                                                                                                                                                                  SHA1

                                                                                                                                                                  8a3a66df1e7d73ca402af29d3e42330a9cbc5307

                                                                                                                                                                  SHA256

                                                                                                                                                                  da14952806274a6f54321cedf869411b6301744dc85922f68ef1999af884c485

                                                                                                                                                                  SHA512

                                                                                                                                                                  790d7d2fbd179fb2378c23d880feda572ee8ee503c4e2fae9ded4792f883eba2014af55774a374b5cd71daab6f3b06cdf785ba0073168b93f89546e94f9e8414

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                                                                                                                                  Filesize

                                                                                                                                                                  97B

                                                                                                                                                                  MD5

                                                                                                                                                                  e403893cb1eff096a3a681a4e18bfc57

                                                                                                                                                                  SHA1

                                                                                                                                                                  2b77a9b05a98def1630f2d224077297c5aa719bc

                                                                                                                                                                  SHA256

                                                                                                                                                                  5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                                                                                                                                  SHA512

                                                                                                                                                                  c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                                                                                                                                  Download Submit

                                                                                                                                                                • memory/180-353-0x00000182C8E40000-0x00000182C8E60000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/180-355-0x00000182C8E00000-0x00000182C8E20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/180-357-0x00000182C9200000-0x00000182C9220000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/184-365-0x0000000004380000-0x0000000004381000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/772-172-0x0000017022E10000-0x0000017022E30000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/772-169-0x0000017022A00000-0x0000017022A20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/772-167-0x0000017022A40000-0x0000017022A60000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/872-159-0x0000000003ED0000-0x0000000003ED1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/964-277-0x00000000046C0000-0x00000000046C1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/964-372-0x0000018E54200000-0x0000018E54220000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1216-111-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1280-95-0x0000023F052D0000-0x0000023F052F0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1280-37-0x0000000003020000-0x0000000003021000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1280-100-0x0000023F058A0000-0x0000023F058C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1280-98-0x0000023F05290000-0x0000023F052B0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1344-73-0x000001C526520000-0x000001C526540000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1344-71-0x000001C526560000-0x000001C526580000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1344-77-0x000001C526930000-0x000001C526950000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1528-301-0x0000000003F30000-0x0000000003F31000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1948-197-0x0000027F85FC0000-0x0000027F85FE0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1948-194-0x0000027F859A0000-0x0000027F859C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1948-192-0x0000027F859E0000-0x0000027F85A00000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2040-8-0x0000000002B00000-0x0000000002B01000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2128-145-0x0000027B9AD90000-0x0000027B9ADB0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2128-149-0x0000027B9B1A0000-0x0000027B9B1C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2128-143-0x0000027B9ADD0000-0x0000027B9ADF0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2164-31-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2636-286-0x0000027E744D0000-0x0000027E744F0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2636-287-0x0000027E74AE0000-0x0000027E74B00000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2636-284-0x0000027E74510000-0x0000027E74530000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3056-311-0x000001CDB0990000-0x000001CDB09B0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3056-313-0x000001CDB0DA0000-0x000001CDB0DC0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3056-308-0x000001CDB09D0000-0x000001CDB09F0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3320-217-0x0000026FC71B0000-0x0000026FC71D0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3320-220-0x0000026FC75C0000-0x0000026FC75E0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3320-213-0x0000026FC71F0000-0x0000026FC7210000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3332-184-0x0000000004950000-0x0000000004951000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3416-230-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3496-323-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3928-136-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3972-253-0x00000000041F0000-0x00000000041F1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4072-335-0x000001A6F5C10000-0x000001A6F5C30000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4072-333-0x000001A6F5800000-0x000001A6F5820000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4072-330-0x000001A6F5840000-0x000001A6F5860000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4160-261-0x00000161EA1A0000-0x00000161EA1C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4160-264-0x00000161EA160000-0x00000161EA180000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4160-266-0x00000161EA590000-0x00000161EA5B0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4188-121-0x00000193B7F00000-0x00000193B7F20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4188-124-0x00000193B8310000-0x00000193B8330000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4188-118-0x00000193B7F40000-0x00000193B7F60000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4252-243-0x000001F07A5A0000-0x000001F07A5C0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4252-237-0x000001F07A1D0000-0x000001F07A1F0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4252-239-0x000001F07A190000-0x000001F07A1B0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4340-87-0x0000000002B00000-0x0000000002B01000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4520-63-0x0000000004640000-0x0000000004641000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4608-206-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4776-347-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4860-34-0x00000172279F0000-0x00000172279F8000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  32KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5092-48-0x00000291409B0000-0x00000291409D0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5092-46-0x0000029140D00000-0x0000029140D20000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5092-21-0x000001EB08FE0000-0x000001EB09000000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5092-18-0x000001EB089D0000-0x000001EB089F0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5092-15-0x000001EB08C20000-0x000001EB08C40000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/5092-51-0x00000291410C0000-0x00000291410E0000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  128KB

                                                                                                                                                                  Download