Overview

overview

8

Static

static

3

82d10f9406...a6.exe

windows7-x64

8

82d10f9406...a6.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    17s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2023 10:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    82d10f94060e7fd044306e2503a55ede369ee71bd85a5319deb5a4c4ab7cc9a6.exe

  • Size

    2.7MB

  • MD5

    63349a9d5b395d7c1fed653dac934f34

  • SHA1

    9bf6732b94b13c612d927602ccf183f114f47970

  • SHA256

    82d10f94060e7fd044306e2503a55ede369ee71bd85a5319deb5a4c4ab7cc9a6

  • SHA512

    c14bac55e8510eefa7899e96f017175a9ff97b7fbb54e14e98c366a07f4f94d71d54482f18f033fab88c59ae2a8b60e51381d93a430cc62f416b78d2e537fe17

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlp3ByYWtxe2dH9FF1A2:c+8X9G3vP3AMhyj

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\82d10f94060e7fd044306e2503a55ede369ee71bd85a5319deb5a4c4ab7cc9a6.exe
    "C:\Users\Admin\AppData\Local\Temp\82d10f94060e7fd044306e2503a55ede369ee71bd85a5319deb5a4c4ab7cc9a6.exe"
    1⤵
      PID:4364
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4440
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4984
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1896
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:1296
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2000
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2940
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2368
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4184
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1000
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:736
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:400
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2100
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3836
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3296
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4064
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4244
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3068
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3208
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3860
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3196
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3820
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2856
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:2516
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:2028
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3332
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4332
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2548
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:2344
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4336
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3024
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4120
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3828
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3040
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:440
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:5028
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:1900
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:2044
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:1004
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4812
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:624
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:1940
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3752
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2040
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3900
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1772
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3084
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4400
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:996
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3200
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:3472
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:4864
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:2124
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:4616
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3348
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:4076
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:2152
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:408
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:1848
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4332
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:4816
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:4028
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:4064
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:2740
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:3024
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4056
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4380
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:2320
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:2640
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:1636
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1036
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:1940
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:3372
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:3392
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3256
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1304
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4908
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4348
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2856

                                                                                                                                                          Network

                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                            Filesize

                                                                                                                                                            471B

                                                                                                                                                            MD5

                                                                                                                                                            4457348ffb6677a1e3a91cb2f4557544

                                                                                                                                                            SHA1

                                                                                                                                                            1df8c2fbfce71f7d83e7725f7eaba9e2c8090bd0

                                                                                                                                                            SHA256

                                                                                                                                                            d71daa46393a3ce3c8f83fe692ef9cbcb72300a7d3ed14991e6be2492a6a1510

                                                                                                                                                            SHA512

                                                                                                                                                            51648f252f29b9860aa1e7b2f8dc2a3e0c5bacf5e0d12655c6f03d7661cba5b8ffc8633dba2b8ea6936a62ac10cdee7d3729b9133ae1f403703832674cc4dbe2

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                            Filesize

                                                                                                                                                            412B

                                                                                                                                                            MD5

                                                                                                                                                            3de2aa3d0c94c4a186b09fecd35a3755

                                                                                                                                                            SHA1

                                                                                                                                                            8d478c5bf2e33b08a7acd5b89a6acb02fa4aa99d

                                                                                                                                                            SHA256

                                                                                                                                                            32af18d66f8e4adb9b19a24aa6e94f0183ea9d50f0d26411f619717d735c4501

                                                                                                                                                            SHA512

                                                                                                                                                            2a47902d65bf70566e3be098a421bbea0ba575c6909cec59bef06f513f0ccc423de8d72e93e2a0dc7aa4c96911f398545206326ba086491cf71e1e36563e918b

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                            Filesize

                                                                                                                                                            2KB

                                                                                                                                                            MD5

                                                                                                                                                            623a637bd549a72c6f18cb3caff0e4c3

                                                                                                                                                            SHA1

                                                                                                                                                            b0d2204b3added5dc92ce3c22e7ab63b8709ed8d

                                                                                                                                                            SHA256

                                                                                                                                                            d9562bef2d34e403af13b39908c73214fc700a483b2d39e6b215eb096ac91bad

                                                                                                                                                            SHA512

                                                                                                                                                            6f1c63f2c5523acd20c426111eaab1eb101c2b719c960d3b346b1dd83d528f585e9a2c8967621c6a04ad17be0b9194ed440aeaa3532b657acf02343d7bf3d21b

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133449504482511848.txt
                                                                                                                                                            Filesize

                                                                                                                                                            74KB

                                                                                                                                                            MD5

                                                                                                                                                            0770cd8fe6784708d08860d93a5cb762

                                                                                                                                                            SHA1

                                                                                                                                                            ec3a74a70a55ac4e73f6ccaf01a7f4b86ca45cf8

                                                                                                                                                            SHA256

                                                                                                                                                            77c4ad43697c8de81a391a842311a1331fb37da159dcfe94eaa23e193479b1c2

                                                                                                                                                            SHA512

                                                                                                                                                            40c0c9f1e3a29320f68248439afe28ab00eef45b3dfbb9a3cc743a2f83374e6c2e8f36c57131a2c1b840c9f99b6c58b29f40ed453b03cd16607745fedae8e511

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DENP3826\microsoft.windows[1].xml
                                                                                                                                                            Filesize

                                                                                                                                                            96B

                                                                                                                                                            MD5

                                                                                                                                                            da2f6534a0b18d822eafa495c037a7f4

                                                                                                                                                            SHA1

                                                                                                                                                            9a5ee14946c817ab6739bed1e22b2b5cfe742802

                                                                                                                                                            SHA256

                                                                                                                                                            e7b5b9346d1dd05e69644850e324798c30355e495e094d019973c444b6ae00a5

                                                                                                                                                            SHA512

                                                                                                                                                            d956be2de58592438cbee1b996472bea59b58245861ec4d6bbf5318efd33716047406883aefd7c4f61fe0fd23caa09d0e6efaf8abb26e982bf3f47a3073d94d3

                                                                                                                                                            Download Submit

                                                                                                                                                          • memory/400-43-0x0000000004380000-0x0000000004381000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/996-230-0x0000000004510000-0x0000000004511000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1004-196-0x000002052C040000-0x000002052C060000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1004-193-0x000002052BC30000-0x000002052BC50000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1004-190-0x000002052BC70000-0x000002052BC90000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1772-207-0x00000000043B0000-0x00000000043B1000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1848-285-0x000001CE4C020000-0x000001CE4C040000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1848-288-0x000001CE4BDD0000-0x000001CE4BDF0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1848-291-0x000001CE4C3E0000-0x000001CE4C400000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/1900-182-0x0000000004510000-0x0000000004511000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2028-116-0x0000000004890000-0x0000000004891000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2152-277-0x0000000003230000-0x0000000003231000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2640-347-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/2940-21-0x0000000004B20000-0x0000000004B21000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3024-333-0x0000024183290000-0x00000241832B0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3024-338-0x00000241838A0000-0x00000241838C0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3024-139-0x00000000045D0000-0x00000000045D1000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3024-331-0x00000241832D0000-0x00000241832F0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3040-159-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3208-82-0x000001AB39940000-0x000001AB39960000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3208-75-0x000001AB39570000-0x000001AB39590000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3208-79-0x000001AB39530000-0x000001AB39550000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3256-390-0x00000281E4080000-0x00000281E40A0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3256-387-0x00000281E40C0000-0x00000281E40E0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3372-381-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3472-243-0x00000257F78A0000-0x00000257F78C0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3472-241-0x00000257F7280000-0x00000257F72A0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3472-238-0x00000257F72C0000-0x00000257F72E0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3820-98-0x000001D822BE0000-0x000001D822C00000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3820-100-0x000001D822BA0000-0x000001D822BC0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3820-102-0x000001D823340000-0x000001D823360000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3828-151-0x000001D82A500000-0x000001D82A520000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3828-149-0x000001D82A100000-0x000001D82A120000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3828-147-0x000001D82A140000-0x000001D82A160000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3836-51-0x0000024AA1470000-0x0000024AA1490000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3836-54-0x0000024AA1430000-0x0000024AA1450000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3836-56-0x0000024AA1840000-0x0000024AA1860000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/3860-90-0x00000000034F0000-0x00000000034F1000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4028-315-0x0000024CAC980000-0x0000024CAC9A0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4028-310-0x0000024CAC570000-0x0000024CAC590000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4028-308-0x0000024CAC5B0000-0x0000024CAC5D0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4056-358-0x000002ADE78A0000-0x000002ADE78C0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4056-362-0x000002ADE7860000-0x000002ADE7880000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4056-365-0x000002ADE7F00000-0x000002ADE7F20000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4064-323-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4184-30-0x0000017161BD0000-0x0000017161BF0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4184-32-0x00000171621E0000-0x0000017162200000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4184-27-0x0000017161E20000-0x0000017161E40000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4244-67-0x00000000033D0000-0x00000000033D1000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4332-300-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4332-128-0x000001B23E1C0000-0x000001B23E1E0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4332-126-0x000001B23DD40000-0x000001B23DD60000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4332-123-0x000001B23DD80000-0x000001B23DDA0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4400-215-0x00000207F5F80000-0x00000207F5FA0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4400-217-0x00000207F5F40000-0x00000207F5F60000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4400-220-0x00000207F6350000-0x00000207F6370000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4440-5-0x0000000004190000-0x0000000004191000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4616-261-0x000001A5E5240000-0x000001A5E5260000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4616-266-0x000001A5E5690000-0x000001A5E56B0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4616-264-0x000001A5E5200000-0x000001A5E5220000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/4864-253-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            4KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5028-172-0x000001A458A60000-0x000001A458A80000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5028-170-0x000001A458450000-0x000001A458470000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download

                                                                                                                                                          • memory/5028-167-0x000001A458490000-0x000001A4584B0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            128KB

                                                                                                                                                            Download