Overview

overview

8

Static

static

3

7a2169b438...80.exe

windows7-x64

8

7a2169b438...80.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    52s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2023 09:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a2169b4381ce77988714aa5c0a94a94a28a83590ced50977d3b1f32bac4a480.exe

  • Size

    3.2MB

  • MD5

    0460297577c81427073e156a8ccfe875

  • SHA1

    f6d85fabc66a0c8a4e1085e9d541f30558b68a12

  • SHA256

    7a2169b4381ce77988714aa5c0a94a94a28a83590ced50977d3b1f32bac4a480

  • SHA512

    beca77a9d809aa1958a18307d198a26a2082a350a49365dee9b1005e5588f6e04dc2a51ff13a6dd65e7747d95a85c114d8e5ba4d21d52581962fb3f2782bedc4

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlEibhEWO2xp:c+8X9G3vP3AMOibh1T

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a2169b4381ce77988714aa5c0a94a94a28a83590ced50977d3b1f32bac4a480.exe
    "C:\Users\Admin\AppData\Local\Temp\7a2169b4381ce77988714aa5c0a94a94a28a83590ced50977d3b1f32bac4a480.exe"
    1⤵
      PID:1568
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2268
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3088
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2272
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4100
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2796
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2160
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1476
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4712
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4020
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:2112
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3104
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3484
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Modifies registry class
            PID:2740
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1872
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3780
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:3104
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3744
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3872
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4140
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4396
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3336
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3316
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3284
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3336
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:2528
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4792
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:2832
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3816
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3176
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1492
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3972
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3684
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:5064
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4620
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2272
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:736
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3432
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:732
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:4620
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3740
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1676
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4980
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3732
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:4808
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:2784
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3484
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3952
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:1496
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3624
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3916
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2128
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:1316
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:4500
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:4512
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:364
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:4476
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:3800
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:1868
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:3568
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:2272
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:4120
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:3564
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:1816
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:3012
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:880
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:2944
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:1592
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:2336
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:112

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                        Filesize

                                                                                                                        471B

                                                                                                                        MD5

                                                                                                                        80581cb5b41f4ac00695f3e3f81b2ebc

                                                                                                                        SHA1

                                                                                                                        9b03d363c70826cc269a6d60f23d21415a5a8fd4

                                                                                                                        SHA256

                                                                                                                        a1196031fbf97b7ae4c0f8d724d526de7068496290e3ba8df8e9b64f2fc01528

                                                                                                                        SHA512

                                                                                                                        98a1c9251b8bd8ccc103544f2a3afd5c9314a61776c8b00c74efbb8d1e878634d98375a346ae004fab77d001a2c13161539db5fb9896336e7934069206e52c01

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                        Filesize

                                                                                                                        412B

                                                                                                                        MD5

                                                                                                                        3e9843b7c7e37fd0b35b6dbdeecf16f8

                                                                                                                        SHA1

                                                                                                                        e025b29ce5d75a76aab8ad8f35f0e24322680d84

                                                                                                                        SHA256

                                                                                                                        d7fb852499dc3f5a84cd0962e1d4a7410fb09bcba00e1ea9f48d21318ec2c097

                                                                                                                        SHA512

                                                                                                                        9d938efda69c00f08b9acdbcfbf9afce5e5561bb4f24c14d8cf2740a325330172aa47f8f4a0256dd1c81285b1636f434b459592de37a4d3c807de9264008a5ff

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        35b7aa556fab040589f8d044cb0b438a

                                                                                                                        SHA1

                                                                                                                        fda69b1eceff425ef19981e8957de1018c29f91c

                                                                                                                        SHA256

                                                                                                                        2fa222eb744f355e9defecf907394a8af2f9f773fe4b3d519fd1663b19ea8684

                                                                                                                        SHA512

                                                                                                                        f4ca6c61b19425d0e03e0b05611baf2fd8c1a3d6abcb76d1ee4e36b0d9c15b3c14f65173712b3cc962ed363410b637184454f6ea03616fa1ff8e5fdaffd9fc84

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PP0GIZJY\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        0dfaf78473f3abc4592af5efa3697131

                                                                                                                        SHA1

                                                                                                                        e726b34092196e52e4bced2e1a91fde0a4bdc5c8

                                                                                                                        SHA256

                                                                                                                        fbdc8ff459fcadbdd38ffc007ac8f401a87d0fef760732ecbed7404f2894ded8

                                                                                                                        SHA512

                                                                                                                        f36c3a0ff9673c555c0509cbfd8767d6a7dc0f2e6e64500b4499eca969e021ee2a8ad2b5bcc9a1391b22d4fa5b4a3e62f4b80ce89006c803374d562853f27c5b

                                                                                                                        Download Submit

                                                                                                                      • memory/364-342-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/732-236-0x000001E135590000-0x000001E1355B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/732-232-0x000001E1351C0000-0x000001E1351E0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/732-234-0x000001E135180000-0x000001E1351A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/736-224-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/1316-318-0x0000000004820000-0x0000000004821000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/1476-22-0x000002D79CD40000-0x000002D79CD60000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1476-19-0x000002D79C930000-0x000002D79C950000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1476-17-0x000002D79C970000-0x000002D79C990000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1492-177-0x00000000046B0000-0x00000000046B1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/1676-255-0x000001D31C8B0000-0x000001D31C8D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1676-257-0x000001D31C870000-0x000001D31C890000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1676-259-0x000001D31CC80000-0x000001D31CCA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1868-365-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2112-34-0x0000000002B10000-0x0000000002B11000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2272-210-0x0000026F03600000-0x0000026F03620000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2272-373-0x00000149149A0000-0x00000149149C0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2272-378-0x0000014914D70000-0x0000014914D90000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2272-208-0x0000026F03640000-0x0000026F03660000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2272-212-0x0000026F03A00000-0x0000026F03A20000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2272-375-0x0000014914960000-0x0000014914980000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2528-153-0x0000000004790000-0x0000000004791000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2740-58-0x0000000003E50000-0x0000000003E51000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2796-11-0x0000000003010000-0x0000000003011000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2832-166-0x00000172EE3D0000-0x00000172EE3F0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2832-163-0x00000172EDFC0000-0x00000172EDFE0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2832-161-0x00000172EE000000-0x00000172EE020000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3104-81-0x0000000002960000-0x0000000002961000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/3316-125-0x0000000004480000-0x0000000004481000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/3336-112-0x000002E706DB0000-0x000002E706DD0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3336-138-0x0000029C866C0000-0x0000029C866E0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3336-114-0x000002E7073C0000-0x000002E7073E0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3336-136-0x0000029C860A0000-0x0000029C860C0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3336-134-0x0000029C860E0000-0x0000029C86100000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3336-110-0x000002E706DF0000-0x000002E706E10000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3484-45-0x00000224C8890000-0x00000224C88B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3484-41-0x00000224C84C0000-0x00000224C84E0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3484-43-0x00000224C8480000-0x00000224C84A0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3624-302-0x000002098D6D0000-0x000002098D6F0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3624-304-0x000002098D690000-0x000002098D6B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3624-307-0x000002098DCA0000-0x000002098DCC0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3684-185-0x0000013AF9940000-0x0000013AF9960000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3684-187-0x0000013AF9900000-0x0000013AF9920000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3684-190-0x0000013AF9D00000-0x0000013AF9D20000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3780-66-0x0000027A16560000-0x0000027A16580000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3780-69-0x0000027A16520000-0x0000027A16540000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3780-71-0x0000027A16920000-0x0000027A16940000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3800-354-0x0000013A3ACA0000-0x0000013A3ACC0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3800-352-0x0000013A3A890000-0x0000013A3A8B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3800-350-0x0000013A3A8D0000-0x0000013A3A8F0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3872-92-0x000001E4DEB40000-0x000001E4DEB60000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3872-89-0x000001E4DEB80000-0x000001E4DEBA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3872-95-0x000001E4DEF50000-0x000001E4DEF70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3952-294-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/4140-102-0x00000000029A0000-0x00000000029A1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/4512-328-0x000002CFF3130000-0x000002CFF3150000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4512-326-0x000002CFF3170000-0x000002CFF3190000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4512-330-0x000002CFF3540000-0x000002CFF3560000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4620-247-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/4808-278-0x000001921D260000-0x000001921D280000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4808-280-0x000001921D220000-0x000001921D240000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4808-282-0x000001921D630000-0x000001921D650000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4980-271-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/5064-200-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download