Overview

overview

8

Static

static

3

58d4e2d4d8...f9.exe

windows7-x64

8

58d4e2d4d8...f9.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    15s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-11-2023 09:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    58d4e2d4d8526b3a337a88bc583397539c7a6888ccfb67b3f2238f86843c2cf9.exe

  • Size

    3.0MB

  • MD5

    51b2e610b6976d3d74a00f43b6747716

  • SHA1

    f0b61e07607cb65e8add01592d95955dbd5e2119

  • SHA256

    58d4e2d4d8526b3a337a88bc583397539c7a6888ccfb67b3f2238f86843c2cf9

  • SHA512

    d33344baed9f7ed6a6538113819b96e93435e453122b8d00457f66625c3e2c60ee4b1d59feb96d0545f5cccf310a94ac57d2bf088c24e582c4fa907bd3383163

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlBsp79ry4q5W7jbj6Z:Q+8X9G3vP3AMgp+5YbjU

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\58d4e2d4d8526b3a337a88bc583397539c7a6888ccfb67b3f2238f86843c2cf9.exe
    "C:\Users\Admin\AppData\Local\Temp\58d4e2d4d8526b3a337a88bc583397539c7a6888ccfb67b3f2238f86843c2cf9.exe"
    1⤵
      PID:1596
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2184
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2496
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      PID:4140
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2204
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3728
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3756
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:560
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4252
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4996
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3200
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1536
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3472
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4252
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4124
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3556
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1208
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4600
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:2024
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:1320
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3048
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:724
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3512
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:696
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3524
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:2024
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3972
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:5012
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1060
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4680
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3648
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4740
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4076
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3564
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:248
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:2716
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4660
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:2616
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:1204
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:2976
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:3448
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4120
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:1648
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:408
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:1768
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1212
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3052
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4760
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3212
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3204
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4880
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3152
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:2108
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3340
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:5016
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4040
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:1388
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:648
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:3488
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4084
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:4184
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:4772
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4076
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:4144
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:2276
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:2208
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:3800
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:1656
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4772
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:1768
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:2224
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:4552

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                          Filesize

                                                                                                                                          471B

                                                                                                                                          MD5

                                                                                                                                          f174999c8fe087d58affeb0445a2b1b8

                                                                                                                                          SHA1

                                                                                                                                          ae87e425ca63cfd4f4c92b650282d12085bdabeb

                                                                                                                                          SHA256

                                                                                                                                          de029818fcb28731f84b68150930a6837ca844258907d5509a898f58b389e5e5

                                                                                                                                          SHA512

                                                                                                                                          ade92f8f020e76ebdd44292f269a3eb4193a112b1d0c0a2fcce05039fddba0cdd72815a67befd04b01978cf5a56180e58147384d623a312aa4be7f836fafccf7

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                          Filesize

                                                                                                                                          412B

                                                                                                                                          MD5

                                                                                                                                          8c7d81415f106ec662788c24a6129bfe

                                                                                                                                          SHA1

                                                                                                                                          ab0cfff798ea54694d2d764922511a1d735e93be

                                                                                                                                          SHA256

                                                                                                                                          13fa7a3f4fdce03fdf924a27726d449fdeaeb16ba8997fbb829e70d1d613dd85

                                                                                                                                          SHA512

                                                                                                                                          5c2fc5c86fce26434bd5542f4618d5dee7576e064fd03a850050978af3c6bd23d298702f20cdc0f7055eae1027de40fc86256a4c79185232be5941d4e1c7e2ff

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                          Filesize

                                                                                                                                          2KB

                                                                                                                                          MD5

                                                                                                                                          ad73227106dc460302f53b4f761438e3

                                                                                                                                          SHA1

                                                                                                                                          4e16e7fb6d7d090c7157ec4cec32c5dd4ddcc0f9

                                                                                                                                          SHA256

                                                                                                                                          ba07196e65cf1707231fc2ee74d709ccb65b5cfaf2453b03e3551719a7f449a5

                                                                                                                                          SHA512

                                                                                                                                          d45767394b777f5d2df09c3ccccb33a4aa8597fb14cb304f506e747bd4d905d081e55ef37e20aaa162b9e44a63ff7f2349d7da075b943f4b4e9f9f3fd2bc88d2

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133433920194874340.txt
                                                                                                                                          Filesize

                                                                                                                                          74KB

                                                                                                                                          MD5

                                                                                                                                          0770cd8fe6784708d08860d93a5cb762

                                                                                                                                          SHA1

                                                                                                                                          ec3a74a70a55ac4e73f6ccaf01a7f4b86ca45cf8

                                                                                                                                          SHA256

                                                                                                                                          77c4ad43697c8de81a391a842311a1331fb37da159dcfe94eaa23e193479b1c2

                                                                                                                                          SHA512

                                                                                                                                          40c0c9f1e3a29320f68248439afe28ab00eef45b3dfbb9a3cc743a2f83374e6c2e8f36c57131a2c1b840c9f99b6c58b29f40ed453b03cd16607745fedae8e511

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133433920194874340.txt
                                                                                                                                          Filesize

                                                                                                                                          74KB

                                                                                                                                          MD5

                                                                                                                                          0770cd8fe6784708d08860d93a5cb762

                                                                                                                                          SHA1

                                                                                                                                          ec3a74a70a55ac4e73f6ccaf01a7f4b86ca45cf8

                                                                                                                                          SHA256

                                                                                                                                          77c4ad43697c8de81a391a842311a1331fb37da159dcfe94eaa23e193479b1c2

                                                                                                                                          SHA512

                                                                                                                                          40c0c9f1e3a29320f68248439afe28ab00eef45b3dfbb9a3cc743a2f83374e6c2e8f36c57131a2c1b840c9f99b6c58b29f40ed453b03cd16607745fedae8e511

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                          Filesize

                                                                                                                                          96B

                                                                                                                                          MD5

                                                                                                                                          da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                          SHA1

                                                                                                                                          9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                          SHA256

                                                                                                                                          e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                          SHA512

                                                                                                                                          d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                          Download Submit

                                                                                                                                        • memory/560-49-0x0000000004430000-0x0000000004431000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/696-144-0x0000000004400000-0x0000000004401000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/1060-170-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/1204-229-0x000001EF1D640000-0x000001EF1D660000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1204-224-0x000001EF1D1E0000-0x000001EF1D200000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1204-227-0x000001EF1D180000-0x000001EF1D1A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1320-111-0x0000020D15160000-0x0000020D15180000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1320-109-0x0000020D14CC0000-0x0000020D14CE0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1320-106-0x0000020D14D00000-0x0000020D14D20000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1656-394-0x000002C963D00000-0x000002C963D20000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1656-396-0x000002C9639B0000-0x000002C9639D0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/1768-263-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/2024-152-0x000001FBF16B0000-0x000001FBF16D0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/2024-155-0x000001FBF1670000-0x000001FBF1690000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/2024-157-0x000001FBF1C80000-0x000001FBF1CA0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/2108-310-0x0000000004160000-0x0000000004161000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/2204-24-0x00000000030B0000-0x00000000030B1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/2208-387-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/2716-201-0x000001889A0E0000-0x000001889A100000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/2716-203-0x000001889A0A0000-0x000001889A0C0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/2716-204-0x000001889A740000-0x000001889A760000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/2976-239-0x0000000004880000-0x0000000004881000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/3048-121-0x0000000004560000-0x0000000004561000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/3052-275-0x0000023AF3CD0000-0x0000023AF3CF0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3052-273-0x0000023AF3820000-0x0000023AF3840000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3052-271-0x0000023AF3860000-0x0000023AF3880000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3152-295-0x000001DF5A3F0000-0x000001DF5A410000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3152-297-0x000001DF5A3B0000-0x000001DF5A3D0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3152-299-0x000001DF5A880000-0x000001DF5A8A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3204-287-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/3472-75-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/3512-129-0x0000025239D30000-0x0000025239D50000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3512-134-0x000002523A380000-0x000002523A3A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3512-132-0x0000025239CF0000-0x0000025239D10000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3564-193-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/3648-177-0x000002720B550000-0x000002720B570000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3648-180-0x000002720B510000-0x000002720B530000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3648-183-0x000002720BBA0000-0x000002720BBC0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3756-37-0x0000017F5AF70000-0x0000017F5AF90000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3756-33-0x0000017F5AB60000-0x0000017F5AB80000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/3756-30-0x0000017F5ABA0000-0x0000017F5ABC0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4076-354-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/4084-333-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/4120-247-0x00000218F2640000-0x00000218F2660000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4120-250-0x00000218F2600000-0x00000218F2620000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4120-252-0x00000218F2A90000-0x00000218F2AB0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4124-82-0x00000290D05E0000-0x00000290D0600000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4124-87-0x00000290D09B0000-0x00000290D09D0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4124-84-0x00000290D05A0000-0x00000290D05C0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4144-367-0x0000025677F30000-0x0000025677F50000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4144-365-0x0000025677B20000-0x0000025677B40000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4144-362-0x0000025677B60000-0x0000025677B80000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4600-99-0x0000000003F30000-0x0000000003F31000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/4660-216-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                          Download

                                                                                                                                        • memory/4772-344-0x0000027BB57B0000-0x0000027BB57D0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4772-342-0x0000027BB5300000-0x0000027BB5320000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4772-339-0x0000027BB5340000-0x0000027BB5360000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4996-63-0x00000220D9BF0000-0x00000220D9C10000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4996-60-0x00000220D95E0000-0x00000220D9600000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/4996-57-0x00000220D9820000-0x00000220D9840000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/5016-328-0x000001637E9E0000-0x000001637EA00000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/5016-323-0x000001637EA20000-0x000001637EA40000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/5016-321-0x000001637E580000-0x000001637E5A0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download

                                                                                                                                        • memory/5016-318-0x000001637E5C0000-0x000001637E5E0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                          Download