Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

b4e24400c4...d6.exe

windows7-x64

8

b4e24400c4...d6.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    40s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 14:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4e24400c4a7a7458919dffbd3f928d1ae282dd38ae6a2492d0b056fc994b3d6.exe

  • Size

    3.3MB

  • MD5

    5caeb6a87bb19a582d67b9a2553a2785

  • SHA1

    ff933c3e89563dfcecaf0fd7813b9a688e87fbad

  • SHA256

    b4e24400c4a7a7458919dffbd3f928d1ae282dd38ae6a2492d0b056fc994b3d6

  • SHA512

    fa969882b95d29640ebab7ed3928cfa49f12962b0b080685bfac9501f927c3d4588b4a600f359f657e9ceac8603cca18c5da2304cac1857f4e8461a0e2581f7f

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlsMPYOZfiOgfY3Y6E9e:Q+8X9G3vP3AMmMPYBXgo6p

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4e24400c4a7a7458919dffbd3f928d1ae282dd38ae6a2492d0b056fc994b3d6.exe
    "C:\Users\Admin\AppData\Local\Temp\b4e24400c4a7a7458919dffbd3f928d1ae282dd38ae6a2492d0b056fc994b3d6.exe"
    1⤵
      PID:4980
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3748
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3696
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2560
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3264
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3304
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4620
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4132
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:2144
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2780
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:2172
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1760
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4472
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2904
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3404
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:1576
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:2312
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:848
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4132
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2448
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4892
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4352
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1736
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3496
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1332
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3872
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3356
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4740
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:2392
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:2512
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4768
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2968
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3140
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3372
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4908
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1120
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3904
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3796
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3768
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4904
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2664
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3908
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:404
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3756
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:2288
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1912
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2508
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:1440
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:5080
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:448
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:1308
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3672
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4504
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4604
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1524
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:1648
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2816
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:1080
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1244
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3636
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:1524
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:1100
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:1920
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:3908
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3752
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:1964
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:3980
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3204

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                            Filesize

                                                                                                            471B

                                                                                                            MD5

                                                                                                            4c89a3253444e3534a8d0804a57ab526

                                                                                                            SHA1

                                                                                                            0b8a68a6f934e1a17b1a78cff5d4d9bb392d22c4

                                                                                                            SHA256

                                                                                                            75254e24703b9eec69f23c9153879875491b3ad72d295d535eacce17025b5ebd

                                                                                                            SHA512

                                                                                                            49f10d7a21100c70b80c4cac6bb8b2ee2af646b5dd385bdc34e564ebee2c2ab49d21575968ecdeed6154682ceba7a02b3c732c7143f741ba8e890ca9dd1ec1c1

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                            Filesize

                                                                                                            412B

                                                                                                            MD5

                                                                                                            52f9a2eb6c3176ceec890ab483824932

                                                                                                            SHA1

                                                                                                            685b442b8e91279125788bb76c512ebc6c44692a

                                                                                                            SHA256

                                                                                                            435e53114c023b0fa33851e98aa6b12336864cd4859174d66d196d974d10a281

                                                                                                            SHA512

                                                                                                            c882331cabbabfc08e1eb9389c2c42293958a94da6f8b0507f6f8954d664d8ba08590f854b1689b891463e3d9d49673f0f74d23886bfae1f7e065b084b7c5415

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9DNZSKKP\microsoft.windows[1].xml
                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            100b85d03c9a92f5de53e1f210dbd426

                                                                                                            SHA1

                                                                                                            f8f4f1693dd0158a5d715a6104cf88d5d8b2097b

                                                                                                            SHA256

                                                                                                            f42a921438bdea6baa25de36a2f4e7a25d21880514a0cecdd5e70914de65a630

                                                                                                            SHA512

                                                                                                            b66c1ef7b555cdc27afa1b62e618945ed41d2e32671b7155f05a81dcdf81d9c5b42d55fd993eaf3b83c60ff7a41198a3db8207367513f524f65ee37112405d91

                                                                                                            Download Submit

                                                                                                          • memory/448-246-0x000002723EFD0000-0x000002723EFF0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/448-248-0x000002723F5E0000-0x000002723F600000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/448-244-0x000002723F220000-0x000002723F240000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1100-328-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/1120-190-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/1244-304-0x00000000028C0000-0x00000000028C1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/1308-269-0x0000020C83EC0000-0x0000020C83EE0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1308-267-0x0000020C838B0000-0x0000020C838D0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1308-265-0x0000020C838F0000-0x0000020C83910000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1332-124-0x0000000002880000-0x0000000002881000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/1440-236-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/1524-312-0x0000023128CD0000-0x0000023128CF0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1524-317-0x00000231292A0000-0x00000231292C0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1524-314-0x0000023128C90000-0x0000023128CB0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1576-62-0x000002DB1FD90000-0x000002DB1FDB0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1576-69-0x000002DB20160000-0x000002DB20180000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1576-64-0x000002DB1FD50000-0x000002DB1FD70000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1648-289-0x000001D4946D0000-0x000001D4946F0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1648-293-0x000001D494AA0000-0x000001D494AC0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1648-291-0x000001D494690000-0x000001D4946B0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1920-337-0x000001F34D1A0000-0x000001F34D1C0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1920-335-0x000001F34D1E0000-0x000001F34D200000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/1920-339-0x000001F34D8B0000-0x000001F34D8D0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/2172-31-0x00000000035F0000-0x00000000035F1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/2312-78-0x0000000003F40000-0x0000000003F41000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/2664-222-0x000001ECB67B0000-0x000001ECB67D0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/2664-220-0x000001ECB61A0000-0x000001ECB61C0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/2664-218-0x000001ECB61E0000-0x000001ECB6200000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/2904-54-0x00000000027A0000-0x00000000027A1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/3140-174-0x000001C53BD40000-0x000001C53BD60000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3140-179-0x000001C53C100000-0x000001C53C120000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3140-177-0x000001C53BD00000-0x000001C53BD20000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3304-8-0x0000000002910000-0x0000000002911000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/3356-137-0x000001A805CC0000-0x000001A805CE0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3356-134-0x000001A8056A0000-0x000001A8056C0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3356-132-0x000001A8056E0000-0x000001A805700000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3496-109-0x0000029342E70000-0x0000029342E90000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3496-111-0x0000029342E30000-0x0000029342E50000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3496-113-0x0000029343240000-0x0000029343260000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3768-210-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/3796-198-0x000001531ACA0000-0x000001531ACC0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3796-202-0x000001531B280000-0x000001531B2A0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3796-200-0x000001531AC60000-0x000001531AC80000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4132-85-0x000002241E270000-0x000002241E290000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4132-20-0x00000144F69C0000-0x00000144F69E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4132-18-0x00000144F63B0000-0x00000144F63D0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4132-15-0x00000144F63F0000-0x00000144F6410000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4132-89-0x000002241E640000-0x000002241E660000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4132-87-0x000002241E230000-0x000002241E250000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4352-101-0x0000000004380000-0x0000000004381000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/4472-43-0x00000261D0D20000-0x00000261D0D40000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4472-41-0x00000261D0920000-0x00000261D0940000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4472-39-0x00000261D0960000-0x00000261D0980000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4604-281-0x0000000003760000-0x0000000003761000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download

                                                                                                          • memory/4740-150-0x00000155A7E60000-0x00000155A7E80000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4740-152-0x00000155A7E20000-0x00000155A7E40000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4740-154-0x00000155A8270000-0x00000155A8290000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/4768-166-0x0000000004350000-0x0000000004351000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                            Download