Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 17:12

General

  • Target

    7f760c43c35d460c2a6881107f75e425.exe

  • Size

    250KB

  • MD5

    7f760c43c35d460c2a6881107f75e425

  • SHA1

    e16a5eeb71a6d37c5035693d446196cbde7d4d28

  • SHA256

    e45ddd68e2c71abb60d8043944ce184e0caa8c78ae4745bb7b765baad45823ca

  • SHA512

    218968e5c59d88da67b2d01c21d189de5e75f324bcd45079c049d748d98d9e90b033c30310f7d294d394c78a946af5a94d1ed0484bc8d30ad64a8e0a7938c0e3

  • SSDEEP

    6144:0hieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:VeKrJJuf86AYcwoaoSbr

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f760c43c35d460c2a6881107f75e425.exe
    "C:\Users\Admin\AppData\Local\Temp\7f760c43c35d460c2a6881107f75e425.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3924
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WinRAR\winrar.jse"
      2⤵
        PID:4688
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g8
          3⤵
            PID:3892
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3892 CREDAT:17410 /prefetch:2
              4⤵
                PID:3232
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\7f760c43c35d460c2a6881107f75e425.exe"
            2⤵
              PID:4416
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 4 127.1
                3⤵
                • Runs ping.exe
                PID:4956
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4220
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
              1⤵
                PID:1372
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:956
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2428
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4428
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:3308
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4568
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                          1⤵
                            PID:1808
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:1308
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:5116
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3212
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4360
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:1156
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:552
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3856
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4128
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4420
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:432
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:5016
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:5480
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:5844
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:6008
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4180
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:5644
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:5692
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1684
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:5520
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4712
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:5364
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3240
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:5828
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:5660
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:2568
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4056
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2808
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:5100
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:5620
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:6132
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:5996
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3712
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3204
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:5720
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:5872
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1652
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:1932
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:5604
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:5648
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:5332
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:5948
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:6120
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:2984
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:4960
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:5276
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:3644
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:5720
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:4960
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:5340
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:5932
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:4352
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:5508
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:5276
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:5548
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:4428
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:2000
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:5532
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:5544
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:3024
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1488
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:5560
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2872
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3660
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:760
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3620
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5972
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4176
                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                  explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:5816
                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:6104
                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                      explorer.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5064
                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:5204
                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:6120
                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                            explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5504
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:6140
                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:5596
                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5208
                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:400
                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4892
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4972
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4516
                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1272
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4128
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2232
                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5636
                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4012
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:2984
                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3620
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:6076
                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3980

                                                                                                                                                                                                              Network

                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              • C:\Program Files\WinRAR\winrar.jse

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9208c38b58c7c7114f3149591580b980

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8154bdee622a386894636b7db046744724c3fc2b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                cb1b908e509020904b05dc6e4ec17d877d394eb60f6ec0d993ceba5839913a0c

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a421c6afa6d25185ec52a8218bddf84537407fd2f6cabe38c1be814d97920cfff693a48b4f48eb30c98437cbbb8ad30ccd28c3b4b7c24379ef36ac361ddfdbf1

                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                471B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a6e46f2a9112ad93b05b9a99af3b121d

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                dc908e930a5d443e54425f50d07a636d70b5b82f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                de015434b71f764ba29310dfde5c3084050cdb8bc9b50eb932b37d0bb1bb0d4f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                7b7e26c597af5c49717e77af04e9a36ae475d1a44c127083c9177d8a01c95981c8c067e12d26d0b9c8a55e856705f2fdc5475fb226040d0068c5d69814dcbc91

                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                412B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c62ef650a01839528696384a57cab9d8

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8b9eceea9fb307d5807ce5b1c46dd81b11a24922

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                8ec04ca7dfde18fbfe542cbe914ea91abfc7a0e3e320e3f3414bb6e738b56290

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5228dec890bc25d3c68ea3ef6477fa0ce53445d3821e72eab8d2eba48f38f0cd4da3e5c674acf2059f02a828a18927c7348bcbedd8f080a789eede306978a8d6

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\16GVVF0P\microsoft.windows[1].xml

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                96B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d60f23b004141aeb2eb90d6a84e68066

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                7b53cc57ce2628a6e5349ea9abd1e96c2c8d6062

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                755595cc4e31d99c254a30a0862716609f1af2e560b77c3402711654a6fae38c

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                8dffce6b703772fba60ace785e8f85294e5c5695a55dafff850e2a6ac188663a9ccd21b1f4bfa607ec20ab987dd52055e714e31828561d30d5dd267194a74d8d

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                255B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a0c4d2f989198272c1e2593e65c9c6cb

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                0fa5cf2c05483bb89b611e0de9db674e9d53389c

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                f3170aeec265cc49ff0f5dcb7ed7897371b0f7d1321f823f53b9b0e3a30e1d23

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                209798b5b153283bea29974c1433fe8b6c14f2a54e57237d021ecc1013b8dc6931dedcc2fe173d121c719901045fdf2215177ba164c05d703f2e88a196252ec4

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                149B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b0ad7e59754e8d953129437b08846b5f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9ed0ae9bc497b3aa65aed2130d068c4c1c70d87a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                cf80455e97e3fede569ea275fa701c0f185eeba64f695286647afe56d29e2c37

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                53e6ce64ad4e9f5696de92a32f65d06dbd459fd12256481706d7e6d677a14c15238e5351f97d2eb7bfb129a0d39f2603c4d14305a86821ed56e9face0bc252b6

                                                                                                                                                                                                              • C:\Users\Public\Desktop\ACROBAT READER DC.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                268B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                57b00ccb3a351d6e45df0c5865020169

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c932af20d06642b4f2f0cb839cded241a90ace3d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                44771198c83ab0ed544795e6d1141330bc8f62129296e13218ef8422a9eab0d5

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                334bf991e5d942a9e7f428948a93863fcacf1280518e5d1992ce36de0e2b3805195e6eadb1fbb70b6c45b371be9a7245c844231eff7c93a8f9b06b0e30d0f529

                                                                                                                                                                                                              • C:\Users\Public\Desktop\FIREFOX.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                212B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e738deb26be0ae6ee9ea74b117af48dc

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                44905d91300e06cc6b293dcc5bd6688d9243495b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                363989f254555ef8fb96df9010ca31c6e2035b10af004aeec341fc2ec26d117d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                12ee06669dddb6bf1f2da6f4be7beb93e17bd9e8480c119cab1ff4c011ee97680d4de7bd8bef68a0426948b2ffb421c32445387c5ed60f1d140e9ff66f96e867

                                                                                                                                                                                                              • C:\Users\Public\Desktop\GOOGLE CHROME.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                250B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7dde836318d7cdbeef35f3d06a6d7b6d

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b26b884a2bd94a432a6e1da3acc5a99dc06c1d42

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                951ba6b01bca3f14eabf9a657497bd172a073984e5a07a6bb39fe4ec8622aaa8

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                74e3154552e693338f587e77a1f01762762406f8a782438ca9041888fb529dec7682692636f1dbd5255cd0922149a3b47c1cad0b3cd782f7f38497526fd945e6

                                                                                                                                                                                                              • C:\Users\Public\Desktop\Internet Explorer.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                218B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                4b9f175d36f729bc91274a478a80f85c

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                7bd79be7dc7fcbe207f16c2aa3fab022a70e7809

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                6533906583c1f768d716d7e9b101d35d1198d9c32a06d882aa626b2e4a51ee02

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                e6ae4ff1cf1ab92cd649ceeda9c59794d8bfd1ca4500f672425d4a74aa48a0e938120d2444a2250513437da04767ff5883e81c7fa5dfa7e71b97bb967c0d5874

                                                                                                                                                                                                              • C:\Users\Public\Desktop\MICROSOFT EDGE.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                252B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                0b7d6914496973c48637995715d6f0d4

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9ac88bd5741ea9825e77511ddd35ad454f05bb99

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9d008d6bf529b562faba50a822eba33df5162e98265362cd23fdf5edfa65a5c8

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ed15ee3776c0eccc4020e006413ecdcdb13ee796376775e2a7fe9d0d7238b6e7633c665f4a78fa3427d9d6bf4309b35876297db2872c26ba0a945dcfc3faf85a

                                                                                                                                                                                                              • C:\Users\Public\Desktop\VLC MEDIA PLAYER.mmc

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                198B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                05a9ce26830a5d720143fff0263529be

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1b726387ca0cd48235aa0c72b95a56ba9d43c85e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                d15d32a3cc4c32b19be8951fd62ccf2fd9e8d40691dee12899a715f0aff298f2

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                89c4fea31b80b5b3e413136c20d3edf81c9c6ecb3725c6025fa3bf7ce505aeec9bb3d269179942db5574dd152808e1d36c58604b093ed74a25049f1b4d98f58f

                                                                                                                                                                                                              • memory/552-175-0x00000000042C0000-0x00000000042C1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/1156-165-0x0000019B926B0000-0x0000019B926D0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/1156-167-0x0000019B92CC0000-0x0000019B92CE0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/1156-163-0x0000019B926F0000-0x0000019B92710000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/1652-397-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/1684-261-0x00000000046C0000-0x00000000046C1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/2428-52-0x0000000003240000-0x0000000003241000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/2808-329-0x0000000004440000-0x0000000004441000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/3204-372-0x00000000036E0000-0x00000000036E1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/3212-156-0x0000000003170000-0x0000000003171000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/3308-62-0x0000018F75A30000-0x0000018F75A50000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/3308-60-0x0000018F75620000-0x0000018F75640000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/3308-58-0x0000018F75660000-0x0000018F75680000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/3924-37-0x0000000000400000-0x00000000004B1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                708KB

                                                                                                                                                                                                              • memory/3924-0-0x0000000000400000-0x00000000004B1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                708KB

                                                                                                                                                                                                              • memory/4056-317-0x000002DC41CD0000-0x000002DC41CF0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4056-319-0x000002DC41C90000-0x000002DC41CB0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4056-321-0x000002DC422A0000-0x000002DC422C0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4128-187-0x0000024651D10000-0x0000024651D30000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4128-185-0x0000024651900000-0x0000024651920000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4128-183-0x0000024651940000-0x0000024651960000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4180-239-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4420-195-0x0000000004150000-0x0000000004151000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4568-82-0x00000000040F0000-0x00000000040F1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4712-269-0x00000251D3AB0000-0x00000251D3AD0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4712-273-0x00000251D4080000-0x00000251D40A0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4712-271-0x00000251D3A70000-0x00000251D3A90000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4960-457-0x000001FD29C80000-0x000001FD29CA0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/4960-459-0x000001FD29C40000-0x000001FD29C60000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5016-208-0x000001764AB00000-0x000001764AB20000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5016-203-0x000001764A520000-0x000001764A540000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5016-205-0x000001764A4E0000-0x000001764A500000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5116-92-0x0000027AE87A0000-0x0000027AE87C0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5116-90-0x0000027AE87E0000-0x0000027AE8800000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5116-94-0x0000027AE8BB0000-0x0000027AE8BD0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5364-283-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5480-215-0x0000000004910000-0x0000000004911000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5604-408-0x000001D2A7FE0000-0x000001D2A8000000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5604-404-0x000001D2A7C20000-0x000001D2A7C40000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5604-406-0x000001D2A79D0000-0x000001D2A79F0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5620-341-0x000001F3E6A20000-0x000001F3E6A40000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5620-337-0x000001F3E6660000-0x000001F3E6680000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5620-339-0x000001F3E6620000-0x000001F3E6640000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5648-420-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5660-309-0x00000000046B0000-0x00000000046B1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/5692-247-0x0000014036A00000-0x0000014036A20000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5692-249-0x00000140367B0000-0x00000140367D0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5692-251-0x0000014036DC0000-0x0000014036DE0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5828-293-0x00000223C8C20000-0x00000223C8C40000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5828-295-0x00000223C9030000-0x00000223C9050000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5828-291-0x00000223C8C60000-0x00000223C8C80000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5872-380-0x00000214BCFF0000-0x00000214BD010000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5872-384-0x00000214BD3C0000-0x00000214BD3E0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5872-382-0x00000214BCFB0000-0x00000214BCFD0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5948-427-0x00000173AA200000-0x00000173AA220000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5948-431-0x00000173AA5D0000-0x00000173AA5F0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5948-429-0x00000173AA1C0000-0x00000173AA1E0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5996-361-0x0000014F80EC0000-0x0000014F80EE0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5996-359-0x0000014F807B0000-0x0000014F807D0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/5996-357-0x0000014F80B00000-0x0000014F80B20000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/6008-225-0x0000028C47FB0000-0x0000028C47FD0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/6008-227-0x0000028C483C0000-0x0000028C483E0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/6008-223-0x0000028C47FF0000-0x0000028C48010000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                              • memory/6120-450-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/6132-350-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB