Overview

overview

8

Static

static

3

e4e646bdd9...d4.exe

windows7-x64

8

e4e646bdd9...d4.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    35s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2023, 18:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4e646bdd956cdb5c914dd28ddb1be55407021088f40c33ac93b3a507ae43ed4.exe

  • Size

    3.4MB

  • MD5

    e68aee8ff895ff1c7ab49ff587a74dbd

  • SHA1

    f385c45fc027490da165819ead4f37364307544f

  • SHA256

    e4e646bdd956cdb5c914dd28ddb1be55407021088f40c33ac93b3a507ae43ed4

  • SHA512

    4fea41125389aa0107a51f3f0d376b9bf34d335ead5ddf77b2e65661eae0fb5869783afc4f72908ad1c2219814559855d5d126eb42c1aefd43ae2bc2aa206d89

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTl3oooVwNk9ju+vPpAl0OM9IOk7nsQ:c+8X9G3vP3AM11uxXPpYM9XPQ

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4e646bdd956cdb5c914dd28ddb1be55407021088f40c33ac93b3a507ae43ed4.exe
    "C:\Users\Admin\AppData\Local\Temp\e4e646bdd956cdb5c914dd28ddb1be55407021088f40c33ac93b3a507ae43ed4.exe"
    1⤵
      PID:1204
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4928
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4568
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1332
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:2916
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3724
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2756
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3492
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:4748
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3260
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:1888
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3296
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Modifies registry class
          PID:3832
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3468
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4748
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:4120
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3624
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4924
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            PID:1044
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1104
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:880
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3768
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:2644
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1576
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4864
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3568
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4200
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:1572
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3304
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4896
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4872
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3224
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:1276
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3752
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2652
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:1332
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:4592
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3272
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:2792
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3208
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4136
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:1556
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4768
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:2928
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3580
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:1068
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3436
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:4440
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:2120
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:3080
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2920
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4620
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4804
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3552
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3100
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4252
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4016
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3344
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:2148
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:944
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3004
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3396
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:2316
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:1404
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:1804
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4652
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3404
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:3872
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1556
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:3316
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:2668
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:1088
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:1852
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:4628
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:4948
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:3948
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:2908
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4440
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:4924
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:2240
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:2764
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:3352

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                        Filesize

                                                                                                                                        471B

                                                                                                                                        MD5

                                                                                                                                        6ddb1d9f924c0dff7f8df6a073bc8eaa

                                                                                                                                        SHA1

                                                                                                                                        8b35715938ca3c18a2e368ea035508d9ac0f7a1a

                                                                                                                                        SHA256

                                                                                                                                        ecac725e28fa74e59ae3a1327c8dec9d01d53818e4261d9f22145e7f0b06f3b0

                                                                                                                                        SHA512

                                                                                                                                        f09b130b3feeff4faa1ef47e94ca8228bca5e09b34b44c546982765858657becbf54b485b9fb8f48d4d57cecece2bae078fef2d6d4b5af92f0b1277d71e06475

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                        Filesize

                                                                                                                                        412B

                                                                                                                                        MD5

                                                                                                                                        62835d564bede5a5993eff40374431ac

                                                                                                                                        SHA1

                                                                                                                                        33a9b18258c6fa81633f9f8dc1a06a63271b7d48

                                                                                                                                        SHA256

                                                                                                                                        c3b4b9b427a3a215a39b5ac11f9aaf493ce55f46ba574f2d1869850e47652a53

                                                                                                                                        SHA512

                                                                                                                                        85acc49e54ed4ade4325008da18f34fa1050b5ff501aa0546853251ae7316afb5aa8aefd0ea94b22ae4eacffd9e9ea8bb7f62a8657c5d785f6b79a007700624b

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133410900904088944.txt
                                                                                                                                        Filesize

                                                                                                                                        75KB

                                                                                                                                        MD5

                                                                                                                                        62d81c2e1e8b21733f95af2a596e4b18

                                                                                                                                        SHA1

                                                                                                                                        91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                                                                        SHA256

                                                                                                                                        a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                                                                        SHA512

                                                                                                                                        c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133410900904088944.txt
                                                                                                                                        Filesize

                                                                                                                                        75KB

                                                                                                                                        MD5

                                                                                                                                        62d81c2e1e8b21733f95af2a596e4b18

                                                                                                                                        SHA1

                                                                                                                                        91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                                                                                                                        SHA256

                                                                                                                                        a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                                                                                                                        SHA512

                                                                                                                                        c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
                                                                                                                                        Filesize

                                                                                                                                        96B

                                                                                                                                        MD5

                                                                                                                                        4114b63fafc98d9307dc8bfae1c379cd

                                                                                                                                        SHA1

                                                                                                                                        8959adf99facaf14c6be813470286c448b0e0b44

                                                                                                                                        SHA256

                                                                                                                                        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

                                                                                                                                        SHA512

                                                                                                                                        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

                                                                                                                                        Download Submit

                                                                                                                                      • memory/880-95-0x0000000004420000-0x0000000004421000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1068-255-0x0000000004030000-0x0000000004031000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1088-374-0x00000000040B0000-0x00000000040B1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/1576-117-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/2148-336-0x000001D738960000-0x000001D738980000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/2148-334-0x000001D738550000-0x000001D738570000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/2148-332-0x000001D738590000-0x000001D7385B0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/2644-106-0x000002437B620000-0x000002437B640000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/2644-104-0x000002437B220000-0x000002437B240000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/2644-102-0x000002437B260000-0x000002437B280000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/2652-185-0x00000000040D0000-0x00000000040D1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/2920-278-0x0000000003070000-0x0000000003071000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/3208-218-0x000001FE4EB30000-0x000001FE4EB50000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3208-216-0x000001FE4EB70000-0x000001FE4EB90000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3208-220-0x000001FE4EF40000-0x000001FE4EF60000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3224-161-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/3260-31-0x0000024C66160000-0x0000024C66180000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3260-33-0x0000024C66120000-0x0000024C66140000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3260-35-0x0000024C66520000-0x0000024C66540000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3272-208-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/3304-152-0x00000290B7CA0000-0x00000290B7CC0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3304-150-0x00000290B7680000-0x00000290B76A0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3304-148-0x00000290B76C0000-0x00000290B76E0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3316-383-0x000001FE07A70000-0x000001FE07A90000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3316-390-0x000001FE07E40000-0x000001FE07E60000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3316-385-0x000001FE07A30000-0x000001FE07A50000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3492-24-0x00000000043A0000-0x00000000043A1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/3552-301-0x0000000003060000-0x0000000003061000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/3568-129-0x000002CB87E00000-0x000002CB87E20000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3568-125-0x000002CB87820000-0x000002CB87840000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3568-127-0x000002CB877E0000-0x000002CB87800000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3752-173-0x000001B6B0560000-0x000001B6B0580000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3752-169-0x000001B6B0190000-0x000001B6B01B0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3752-171-0x000001B6B0150000-0x000001B6B0170000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3832-48-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/3872-362-0x000002341EE20000-0x000002341EE40000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3872-360-0x000002341EA20000-0x000002341EA40000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/3872-358-0x000002341EA60000-0x000002341EA80000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4016-324-0x00000000040F0000-0x00000000040F1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/4120-70-0x00000000029E0000-0x00000000029E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/4136-232-0x0000000004410000-0x0000000004411000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/4200-140-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/4252-312-0x000002C17F3E0000-0x000002C17F400000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4252-314-0x000002C17F9F0000-0x000002C17FA10000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4252-309-0x000002C17F620000-0x000002C17F640000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4440-268-0x0000017CCEB40000-0x0000017CCEB60000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4440-266-0x0000017CCE730000-0x0000017CCE750000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4440-263-0x0000017CCE770000-0x0000017CCE790000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4592-193-0x000001EF6FE40000-0x000001EF6FE60000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4592-195-0x000001EF6FE00000-0x000001EF6FE20000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4592-197-0x000001EF70200000-0x000001EF70220000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4652-351-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                        Download

                                                                                                                                      • memory/4748-55-0x00000243E6A60000-0x00000243E6A80000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4748-57-0x00000243E6A20000-0x00000243E6A40000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4748-59-0x00000243E6E30000-0x00000243E6E50000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4768-243-0x0000021237950000-0x0000021237970000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4768-239-0x0000021237580000-0x00000212375A0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4768-241-0x0000021237540000-0x0000021237560000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4804-291-0x0000022944620000-0x0000022944640000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4804-286-0x0000022944260000-0x0000022944280000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4804-288-0x0000022944220000-0x0000022944240000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4924-82-0x00000260EF6D0000-0x00000260EF6F0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4924-80-0x00000260EEFC0000-0x00000260EEFE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download

                                                                                                                                      • memory/4924-78-0x00000260EF300000-0x00000260EF320000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                        Download