Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

26f18e04a1...30.exe

windows7-x64

10

26f18e04a1...30.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    27s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 03:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    26f18e04a196e2e85d8297086b338e30.exe

  • Size

    288KB

  • MD5

    26f18e04a196e2e85d8297086b338e30

  • SHA1

    245e479278a7ca0356c9888e246f9e506739768b

  • SHA256

    b136434e8995180965964fa8b46b50173b6a6f500c80fc5a2b548a008d749493

  • SHA512

    ddde4d05a0b45249784af0aa68892a453b3f7cea46097ced149967702facc34047e6975f661a734a115b946f66b0705d929ecab64b3b4f690ba07660eaa6815c

  • SSDEEP

    6144:xX8JXgMQUXu+9qjCTWeqKas8hiAHlkyvbhA5qLXtE8VZP6lnrlZdgpP:uGM7u+xWEAyeAGy8V168P

Score
10/10
evasionpersistencespywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Disables taskbar notifications via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\26f18e04a196e2e85d8297086b338e30.exe
    "C:\Users\Admin\AppData\Local\Temp\26f18e04a196e2e85d8297086b338e30.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4916
    • C:\Users\Admin\AppData\Local\Temp\26f18e04a196e2e85d8297086b338e30.exe
      C:\Users\Admin\AppData\Local\Temp\26f18e04a196e2e85d8297086b338e30.exe startC:\Users\Admin\AppData\Roaming\BE99D\81EA7.exe%C:\Users\Admin\AppData\Roaming\BE99D
      2⤵
        PID:1092
      • C:\Users\Admin\AppData\Local\Temp\26f18e04a196e2e85d8297086b338e30.exe
        C:\Users\Admin\AppData\Local\Temp\26f18e04a196e2e85d8297086b338e30.exe startC:\Program Files (x86)\9D913\lvvm.exe%C:\Program Files (x86)\9D913
        2⤵
          PID:3552
        • C:\Program Files (x86)\LP\A77B\DA52.tmp
          "C:\Program Files (x86)\LP\A77B\DA52.tmp"
          2⤵
            PID:4456
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2920
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4656
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:408
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1528
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:2356
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3836
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2012
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4572
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2616
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:1776
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3544
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4304
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4620
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4292
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3500
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3352
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:4660
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3600
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1544
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4420
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4332
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3856
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4908
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3360
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:428
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3888
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4596
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4424
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2272
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4956
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1188
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:316
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2176
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:1584
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3032
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:2528
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3068
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3536
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3944
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3776
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3076
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1500
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:4012
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:228
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:2120
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4256
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3496
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4736
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:2792
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3408
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3560
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:1760
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:2496
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:3368
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:4256
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:1044
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:3972
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:1528
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:1800
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:4864
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:3120
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:3116
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:3224
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:2984
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:3332
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:1140
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1188
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:4528
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:3672
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:1100
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2332
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4648
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3268
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4200
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2956
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2860
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3540
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2644
                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1200
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4288
                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4004

                                                                                                                                                                      Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      • C:\Program Files (x86)\LP\A77B\DA52.tmp
                                                                                                                                                                        Filesize

                                                                                                                                                                        102KB

                                                                                                                                                                        MD5

                                                                                                                                                                        3dd4e5cd0cb32f735268a740c647065a

                                                                                                                                                                        SHA1

                                                                                                                                                                        5e88431137152bf76f61d06b1c2086ecd5082a76

                                                                                                                                                                        SHA256

                                                                                                                                                                        a1cb303db454c3faa73fa6705c9a7ce126110615879047fbd579d2c813fba535

                                                                                                                                                                        SHA512

                                                                                                                                                                        37463297b6e127dc2689f2b998b14042189baa26727ab1770fc482035b09df2cd3f349fb11038fabde84d0b4a5a07bfc6b5c619001ddc70c9c37c0aa87b3fe04

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                        Filesize

                                                                                                                                                                        471B

                                                                                                                                                                        MD5

                                                                                                                                                                        fcff0230b5d2518aa5bcb53e5cb6bd95

                                                                                                                                                                        SHA1

                                                                                                                                                                        84e02eab4dc8e963711ad054dda8073192c66f04

                                                                                                                                                                        SHA256

                                                                                                                                                                        8c0fad7b8bd59ddefd60d837653fae5bc4010ab28cbf658b4c3fe7092fc392c0

                                                                                                                                                                        SHA512

                                                                                                                                                                        a334311a9c0ec08264731a82e8f55b47cb3a21e3e95b0cda4881de5a523a81cc783ebfaedeb002a653f1cef71bcc0a3f6abc3e875cfc9b5db3a4ce637b29bc5b

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                        Filesize

                                                                                                                                                                        412B

                                                                                                                                                                        MD5

                                                                                                                                                                        b12884041b64d04e1314c95cc413f602

                                                                                                                                                                        SHA1

                                                                                                                                                                        8144f181e1f1ee2aaac5d26c05ee0ab10e36805e

                                                                                                                                                                        SHA256

                                                                                                                                                                        ed9e04dc7325f7b1dd365c70a0b425f323953b3a9016e353774d1bbebeca9b9f

                                                                                                                                                                        SHA512

                                                                                                                                                                        9061820202928d66640c8ad006eb083358acd88a479f453f3bae4e9626da35bcee8bf2d2d08b59117c0ca0029301444c54fd38e4e21488c62946f2de12713516

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                                        Filesize

                                                                                                                                                                        2KB

                                                                                                                                                                        MD5

                                                                                                                                                                        ec7c6fe41080a8f8a6a70824b3f6bc09

                                                                                                                                                                        SHA1

                                                                                                                                                                        e1da253ae67873e67cc57c7aab66c783b85754e2

                                                                                                                                                                        SHA256

                                                                                                                                                                        ea5d749ef67e099836b7694e2d1930f1134f06a577ec2d14b7edee7285a0debb

                                                                                                                                                                        SHA512

                                                                                                                                                                        9860dc7ed67ce6185d2446925d1bac9c9125d6428eada50d33305ef473f4a1aa1ea74c0dcf314cb9bcdc6109a0e403aaf678dd7e06abcd41ad9545071d0eb1c1

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BHN90SAO\microsoft.windows[1].xml
                                                                                                                                                                        Filesize

                                                                                                                                                                        97B

                                                                                                                                                                        MD5

                                                                                                                                                                        a49784c6007e88174d13fd2a1d1603c8

                                                                                                                                                                        SHA1

                                                                                                                                                                        96351722a846ad8a396b7cd3285ac30a8edf3768

                                                                                                                                                                        SHA256

                                                                                                                                                                        bf97a280596c60fa7130725b7426e7cd5ccfb759c909b5ef0b1575df2654ca91

                                                                                                                                                                        SHA512

                                                                                                                                                                        b0c5f6550c560e3bee33be9261bee95a006cd63a57d56b3a4b6c3c8f9ca2c6f222bfd2e8933e663f4b644457b48eb638160c8b9a6814b47a3fd4760f74f825ec

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\BE99D\D913.E99
                                                                                                                                                                        Filesize

                                                                                                                                                                        996B

                                                                                                                                                                        MD5

                                                                                                                                                                        55d609614c9684bacd7293c5868dd1bf

                                                                                                                                                                        SHA1

                                                                                                                                                                        2159710a05c55ce408bf16b75a0d91a5b1bfe653

                                                                                                                                                                        SHA256

                                                                                                                                                                        ef51ae7a8f3e35b900a5ef6baa34244f8315c5c37a6f06c1d63a4a8f1f35b899

                                                                                                                                                                        SHA512

                                                                                                                                                                        0a2f7054d31a5e1f0944874cd0d08a84131ebe0341e688e9186a370753dd86db395089e664d87dc4dda6dff72f106f312792467536f9b737abf7c9892853dd20

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\BE99D\D913.E99
                                                                                                                                                                        Filesize

                                                                                                                                                                        600B

                                                                                                                                                                        MD5

                                                                                                                                                                        115c07d6d939b1071fdd014a98a78dc5

                                                                                                                                                                        SHA1

                                                                                                                                                                        71409bdf8b44a1a5259f9bc8cbb3153c09acd95a

                                                                                                                                                                        SHA256

                                                                                                                                                                        f19ddadcb78693500db22471f3704e38a1c7d7ee6118541f5f4a9e1402876381

                                                                                                                                                                        SHA512

                                                                                                                                                                        ee12b594151b19faf1b4b5c4c2071decdf45217686853d76e75e9aeb90accf1ec34cab95cf3569711fcf142601c0ec906745b4a33d40e21e5466e05608e130b6

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\BE99D\D913.E99
                                                                                                                                                                        Filesize

                                                                                                                                                                        1KB

                                                                                                                                                                        MD5

                                                                                                                                                                        1055cc88a8561765ea2a93a6bf3e6f48

                                                                                                                                                                        SHA1

                                                                                                                                                                        9f432828a8172999d3c91290318bbcccd96adb14

                                                                                                                                                                        SHA256

                                                                                                                                                                        469ab5df54ec7709a82a013177b9a423a377a09f0e3a1da44604d13d94412f1a

                                                                                                                                                                        SHA512

                                                                                                                                                                        0a8195c1b496dbe892d847c6f1b1630c77e15f74b80d27f2dbc229670f3fd80df15216ddf85bf5aa298ec636e1351bca268d02a79b5ccb4cf910db44e13cd6d7

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • memory/228-553-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/316-504-0x0000000004920000-0x0000000004921000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1092-15-0x0000000000720000-0x0000000000820000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1024KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1092-320-0x0000000000720000-0x0000000000820000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1024KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1092-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        428KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1188-491-0x0000022779900000-0x0000022779920000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1188-493-0x0000022779D00000-0x0000022779D20000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1188-489-0x0000022779940000-0x0000022779960000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1528-297-0x0000000003770000-0x0000000003771000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1584-515-0x000002DC98C60000-0x000002DC98C80000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1584-512-0x000002DC98CA0000-0x000002DC98CC0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1584-518-0x000002DC992C0000-0x000002DC992E0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1760-604-0x0000023279C00000-0x0000023279C20000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/1760-602-0x0000023279C40000-0x0000023279C60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2012-321-0x00000000028F0000-0x00000000028F1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2272-481-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2616-344-0x0000014D29300000-0x0000014D29320000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2616-341-0x0000014D28CE0000-0x0000014D28D00000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2616-339-0x0000014D28D20000-0x0000014D28D40000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2792-585-0x00000161EFBB0000-0x00000161EFBD0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2792-583-0x00000161EF5A0000-0x00000161EF5C0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/2792-581-0x00000161EF5E0000-0x00000161EF600000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3032-529-0x0000000002B80000-0x0000000002B81000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3068-541-0x000001FEFD030000-0x000001FEFD050000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3068-536-0x000001FEFCC60000-0x000001FEFCC80000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3068-538-0x000001FEFCC20000-0x000001FEFCC40000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3408-595-0x00000000048C0000-0x00000000048C1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3496-574-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3500-383-0x0000000003340000-0x0000000003341000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3552-133-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        428KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3552-405-0x0000000000600000-0x0000000000700000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1024KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3552-134-0x0000000000600000-0x0000000000700000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1024KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3600-409-0x0000000003190000-0x0000000003191000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3836-304-0x00000184AEA70000-0x00000184AEA90000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3836-306-0x00000184AEA30000-0x00000184AEA50000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3836-308-0x00000184AEE40000-0x00000184AEE60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/3888-456-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4256-563-0x0000021F92B90000-0x0000021F92BB0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4256-561-0x0000021F92BD0000-0x0000021F92BF0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4256-566-0x0000021F92FA0000-0x0000021F92FC0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4292-369-0x000002620C010000-0x000002620C030000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4292-371-0x000002620C420000-0x000002620C440000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4292-367-0x000002620C050000-0x000002620C070000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4304-360-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4332-432-0x0000000003310000-0x0000000003311000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        4KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4420-418-0x000002A361120000-0x000002A361140000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4420-416-0x000002A361160000-0x000002A361180000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4420-420-0x000002A361520000-0x000002A361540000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4424-466-0x000001C15F710000-0x000001C15F730000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4424-468-0x000001C15FB20000-0x000001C15FB40000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4424-464-0x000001C15F750000-0x000001C15F770000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4456-355-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        116KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4456-356-0x0000000000680000-0x0000000000780000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1024KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4456-357-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        116KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4660-393-0x000002554ED00000-0x000002554ED20000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4660-395-0x000002554F110000-0x000002554F130000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4660-391-0x000002554ED40000-0x000002554ED60000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4908-440-0x000002CE4DFF0000-0x000002CE4E010000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4908-444-0x000002CE4E3C0000-0x000002CE4E3E0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4908-442-0x000002CE4DFB0000-0x000002CE4DFD0000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        128KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4916-381-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        428KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4916-2-0x0000000000600000-0x0000000000700000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1024KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4916-526-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        428KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4916-136-0x0000000000600000-0x0000000000700000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        1024KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4916-131-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        428KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4916-12-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        428KB

                                                                                                                                                                        Download

                                                                                                                                                                      • memory/4916-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                        Filesize

                                                                                                                                                                        428KB

                                                                                                                                                                        Download