Overview

overview

8

Static

static

3

e956876035...67.exe

windows7-x64

8

e956876035...67.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    38s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2023 14:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e956876035a695a5a2c829d71b14f3df0b0bb642ff10ad64460727dd76c9fd67.exe

  • Size

    2.9MB

  • MD5

    640b1aae32425486aac277062bd408a7

  • SHA1

    a1d6e70d3abd96c7c4950a934ceb60a60a91c998

  • SHA256

    e956876035a695a5a2c829d71b14f3df0b0bb642ff10ad64460727dd76c9fd67

  • SHA512

    1116e1c832b58d9a32e1f7f9106419dd44e113c62a85563a52f099521526b8232418ab6bc45e1aa27e6548e9e60a8bbb873e6977be9b78123fb467ecb5efe561

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTl9TvrJUuj3P:Q+8X9G3vP3AMTTjf

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e956876035a695a5a2c829d71b14f3df0b0bb642ff10ad64460727dd76c9fd67.exe
    "C:\Users\Admin\AppData\Local\Temp\e956876035a695a5a2c829d71b14f3df0b0bb642ff10ad64460727dd76c9fd67.exe"
    1⤵
      PID:1444
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2616
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4280
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4308
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3164
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3912
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4332
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3140
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3136
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3148
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4772
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3748
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2700
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4788
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:1092
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3660
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3232
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:2340
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Modifies registry class
            PID:3724
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1936
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:2896
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4212
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:972
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2988
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:2208
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4892
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:1056
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4888
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:2912
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:5080
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3700
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:464
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:2668
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4256
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2324
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3948
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4692
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4920
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:1208
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1864
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:2400
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1776
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4940
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:3676
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:2928
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2568
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3220
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2144
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2372
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:2816
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3676
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:2916
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:1776
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:1972
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:4024
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:1720
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:2128
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:2928
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:1464
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2068
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3700
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4772
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4744
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4036
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:1572
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4072
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:4264
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4308
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1032
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:1556
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:2360
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:4456

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                      Filesize

                                                                                                                      471B

                                                                                                                      MD5

                                                                                                                      3a5eccf57e32b259790e1058818c9931

                                                                                                                      SHA1

                                                                                                                      ee42a678927d7f08b9ff8013f51927f641b52a92

                                                                                                                      SHA256

                                                                                                                      db09c94dbe21e14a95d68ffb7f7acdf00973fa3d8dc4f2dd16af805ea1c23fc8

                                                                                                                      SHA512

                                                                                                                      2e89da3e4f9a853df61efa796bdb04e4837e8798d9e9d9484babe4632a91afdf9797763af56831bba16dcdbac577a34342c4e613db26bf6552cce931406b81cd

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                      Filesize

                                                                                                                      412B

                                                                                                                      MD5

                                                                                                                      1ee84aa28ab2731894a984363b936722

                                                                                                                      SHA1

                                                                                                                      ce878aa6f39265b7e39d57f100f0bc37d7e3d6aa

                                                                                                                      SHA256

                                                                                                                      a0863235b7049ebaca1f2e4dabe451a81acc3d929c79dbb9b78ec1f7cfcd5660

                                                                                                                      SHA512

                                                                                                                      9980f80eedb06795ea82b80888d2d9cbd233b248f1defc16270313394abbb800729f73ea599642affeb7796039c29a2a3e266cdcb3a16e6ee7421a85fe4ae368

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      f8aeae2b66267bb09997cdcc7f45e2d6

                                                                                                                      SHA1

                                                                                                                      7bceaf5a5943f5faa880e5f57184a4fb3cea6f59

                                                                                                                      SHA256

                                                                                                                      7d139d2959d6b0aeb280f59e3303a707b7fc0911b48180467793c987fee3a3f7

                                                                                                                      SHA512

                                                                                                                      9754ef13524672438fc19a46e44ce3130758c74a142244f98166f7a77a86ccf981d7d429dc1c4c8e7f3ce619b22da30cbd6057079a8f34b8e7201b33ca5e809c

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GQQOXP13\microsoft.windows[1].xml
                                                                                                                      Filesize

                                                                                                                      96B

                                                                                                                      MD5

                                                                                                                      5b94dda8b3f9f4456023fe069e82cdb5

                                                                                                                      SHA1

                                                                                                                      debf7ca22c5d613cebf15520f6578830450ad8ac

                                                                                                                      SHA256

                                                                                                                      84a7082c6e62fb0ea8c2d573fb9910aa711014724a4a6717f4588963f23974f9

                                                                                                                      SHA512

                                                                                                                      14134d08241d33ce1cc4bbcdbf753e550b72f9fa36ac91d0f96efa303fd320f755af42c70f16d8912f52c7e72ca9d7c0502ae6bbba1b91e48b4ff7e9ea917019

                                                                                                                      Download Submit

                                                                                                                    • memory/1056-134-0x000001B14AB40000-0x000001B14AB60000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1056-132-0x000001B14AB80000-0x000001B14ABA0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1056-136-0x000001B14AF50000-0x000001B14AF70000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1208-224-0x000002022D440000-0x000002022D460000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1208-226-0x000002022D400000-0x000002022D420000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1208-229-0x000002022D810000-0x000002022D830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1464-361-0x000001633F7B0000-0x000001633F7D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1464-365-0x000001633FB80000-0x000001633FBA0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1464-363-0x000001633F770000-0x000001633F790000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1720-344-0x0000028671580000-0x00000286715A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1720-338-0x00000286711B0000-0x00000286711D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1720-341-0x0000028671170000-0x0000028671190000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1776-315-0x000001694A990000-0x000001694A9B0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1776-317-0x000001694A950000-0x000001694A970000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1776-251-0x000001F9A0B70000-0x000001F9A0B90000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1776-248-0x000001F9A0760000-0x000001F9A0780000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1776-322-0x000001694AD60000-0x000001694AD80000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1776-245-0x000001F9A07A0000-0x000001F9A07C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1864-237-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/1972-330-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/2128-353-0x00000000044E0000-0x00000000044E1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/2144-284-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/2208-124-0x0000000004400000-0x0000000004401000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/2340-69-0x0000011EF75C0000-0x0000011EF75E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2340-67-0x0000011EF71B0000-0x0000011EF71D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2340-65-0x0000011EF71F0000-0x0000011EF7210000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2668-182-0x000001C020D40000-0x000001C020D60000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2668-180-0x000001C020930000-0x000001C020950000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2668-178-0x000001C020970000-0x000001C020990000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2816-296-0x0000015D68FF0000-0x0000015D69010000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2816-294-0x0000015D689E0000-0x0000015D68A00000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2816-292-0x0000015D68C20000-0x0000015D68C40000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2896-92-0x000001D70AC50000-0x000001D70AC70000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2896-89-0x000001D70AC90000-0x000001D70ACB0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2896-95-0x000001D70B260000-0x000001D70B280000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2928-271-0x00000216E9FC0000-0x00000216E9FE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2928-268-0x00000216E9C00000-0x00000216E9C20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2928-270-0x00000216E99B0000-0x00000216E99D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2988-112-0x0000024C44060000-0x0000024C44080000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2988-109-0x0000024C440A0000-0x0000024C440C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/2988-115-0x0000024C44680000-0x0000024C446A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/3136-30-0x00000000046D0000-0x00000000046D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/3140-21-0x0000022F28850000-0x0000022F28870000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/3140-19-0x0000022F28440000-0x0000022F28460000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/3140-15-0x0000022F28480000-0x0000022F284A0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/3660-57-0x0000000003430000-0x0000000003431000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/3676-307-0x00000000029D0000-0x00000000029D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/3700-170-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/3724-81-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/3912-8-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/3948-203-0x00000166860A0000-0x00000166860C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/3948-206-0x00000166866C0000-0x00000166866E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/3948-201-0x00000166860E0000-0x0000016686100000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/4212-101-0x0000000004420000-0x0000000004421000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/4256-193-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/4692-216-0x0000000003E90000-0x0000000003E91000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/4772-40-0x0000019EDD6B0000-0x0000019EDD6D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/4772-42-0x0000019EDDCC0000-0x0000019EDDCE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/4772-38-0x0000019EDD6F0000-0x0000019EDD710000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/4888-148-0x0000000004140000-0x0000000004141000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/4940-260-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5080-159-0x00000198C3CC0000-0x00000198C3CE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/5080-157-0x00000198C36A0000-0x00000198C36C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/5080-155-0x00000198C36E0000-0x00000198C3700000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download