Overview

overview

10

Static

static

3

66767aa4a0...00.exe

windows7-x64

10

66767aa4a0...00.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    49s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 00:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    66767aa4a05b47be09341a14495e3a00.exe

  • Size

    285KB

  • MD5

    66767aa4a05b47be09341a14495e3a00

  • SHA1

    b131c4f2dd41d4cf02a95d875490a0c507bf2620

  • SHA256

    b049f8733eaaede8df5608fc40aa5dc2c73e41d1130eb5a1756c2f71e86fe9eb

  • SHA512

    c8238c89e912569cb99726c31c8c58f7c6f69823d3dc6c1faa36f6fb83d5a59ff126995a9fb1a187090580f2c565c1868919478624be8b1427374304bde95af5

  • SSDEEP

    6144:kYf6JhBit/tmzEnxhC4wUFr+9C4JqsTZ3BwGoYm4u0QFWeH:XaBitjwUFr+/qsThBw9350c

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\66767aa4a05b47be09341a14495e3a00.exe
    "C:\Users\Admin\AppData\Local\Temp\66767aa4a05b47be09341a14495e3a00.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4340
    • C:\Users\Admin\AppData\Local\Temp\66767aa4a05b47be09341a14495e3a00.exe
      C:\Users\Admin\AppData\Local\Temp\66767aa4a05b47be09341a14495e3a00.exe startC:\Users\Admin\AppData\Roaming\A28EC\29E50.exe%C:\Users\Admin\AppData\Roaming\A28EC
      2⤵
        PID:1216
      • C:\Users\Admin\AppData\Local\Temp\66767aa4a05b47be09341a14495e3a00.exe
        C:\Users\Admin\AppData\Local\Temp\66767aa4a05b47be09341a14495e3a00.exe startC:\Program Files (x86)\ECCB4\lvvm.exe%C:\Program Files (x86)\ECCB4
        2⤵
          PID:1364
        • C:\Program Files (x86)\LP\500A\DCB4.tmp
          "C:\Program Files (x86)\LP\500A\DCB4.tmp"
          2⤵
          • Executes dropped EXE
          PID:5844
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2180
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:600
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2276
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1544
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:6136
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5216
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        PID:5996
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:436
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:4068
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2288
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4344
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3636
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4404
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3424
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              PID:3360
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3440
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:532
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2172
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1960
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4856
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4468
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:536
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4300
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:3440
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3548
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:5312
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4776
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:5264
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:2304
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4924
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:984
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                      • Modifies Installed Components in the registry
                                      • Enumerates connected drives
                                      • Checks SCSI registry key(s)
                                      • Modifies registry class
                                      PID:4856
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:5656
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4888
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:2396
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4328
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4872
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2092
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4956
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:5248
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3708
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4424
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4860
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:756
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2968
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3684
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4320
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1040
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3712
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3104
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:2460
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:1756
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:5252
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:4456
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:5312
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2888
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:4444
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:3688
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3708
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:3764
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:5392
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:5524
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:5540
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:5124
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:2372
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:4512
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:4368
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:4216
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:1568
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:5760
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3900
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:1712
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4944
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:2832
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:3044
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:532
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:1656
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:5776
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4332
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:3536
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:3412
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:5972
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:624
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:3848
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:3844
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:1724
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1372

                                                                                                                                                  Network

                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\Program Files (x86)\LP\500A\DCB4.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          101KB

                                                                                                                                                          MD5

                                                                                                                                                          debb2016f85b326c4b77fbedd9718e10

                                                                                                                                                          SHA1

                                                                                                                                                          27c4366a0b61240d1cb6ceec6901a77f085d96e9

                                                                                                                                                          SHA256

                                                                                                                                                          d45a36a5503f09a0c5e808289a5ce61549b678339163cbfc7ddb6b646e1354f0

                                                                                                                                                          SHA512

                                                                                                                                                          6230c1ca879f5fa22d7982ff2d1795f8fcd85e9c3e8ac400474f0b8084f8530e417f62e8cf20f41f865a86c3acaa48d3e872b087729112dd2ae0e3c78890ecab

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                          Filesize

                                                                                                                                                          471B

                                                                                                                                                          MD5

                                                                                                                                                          4b61c8bc02084c9a18b060a6e5a49142

                                                                                                                                                          SHA1

                                                                                                                                                          757d52408394650a04254a99ba275ae1e3af739f

                                                                                                                                                          SHA256

                                                                                                                                                          ab0bf9e2d53662bafe1b19e35cb782741d25c8af2dd1bd2cf1c51c0716d10ffc

                                                                                                                                                          SHA512

                                                                                                                                                          eac2bc6e0e654c5a633c8fe48503c243c6bc5a32de391c50f911f54aa15233e30dd2d87df4a630b1afe45ea2405c4ed370fb65eff85f4b52fc87771c1473c751

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                          Filesize

                                                                                                                                                          412B

                                                                                                                                                          MD5

                                                                                                                                                          863df91f1248abd18bf640a56bdf9375

                                                                                                                                                          SHA1

                                                                                                                                                          7d998cc8c3e8e57daec3b12ef46e7ebd9530b593

                                                                                                                                                          SHA256

                                                                                                                                                          bae12dca7b0fb62e527187b2d98403eaec1cfa9bd8b1737d04860ce4e2237d9b

                                                                                                                                                          SHA512

                                                                                                                                                          ba0a87fa0bfd9a2bc0d1408fd21db4a241dea9d45b8c1ddaf57c1e668d563f8044aec24958bb99cf680eaf759d68b098f9c3070b4e2452f2c373ec6a58bb2a33

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          1ad2c14986147d1270172ce279fc66d8

                                                                                                                                                          SHA1

                                                                                                                                                          b79dec489379be32cf6576f4568adf6460607fa6

                                                                                                                                                          SHA256

                                                                                                                                                          a638759a203d553bb6364b510327f8be5e5d5e3c6ff8879ecc9af8df21479ddc

                                                                                                                                                          SHA512

                                                                                                                                                          a6728239e5ad0a8cc624645f939728d65b3dcf6d80768bf2d6424d41e7726f448446c4c8e663bcdbb9f1168a5c80133c91333c7394cf8af4c2fb4a6c254075d1

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\V50TXLKS\microsoft.windows[1].xml
                                                                                                                                                          Filesize

                                                                                                                                                          97B

                                                                                                                                                          MD5

                                                                                                                                                          0dd9849d7dcb276fe7952fbef01f27d2

                                                                                                                                                          SHA1

                                                                                                                                                          696b4212cc8a84291f88203695dbfe81567db0b9

                                                                                                                                                          SHA256

                                                                                                                                                          ab905cb2e3d901f2d2e2abbe041717c3c220c2fbf8f5a6b84554246918e1ccd0

                                                                                                                                                          SHA512

                                                                                                                                                          7c9ee87c2c2a4bb137141e1fdf4d5f64e3873c734dc3848bc98d9f4c5511c11124a700ce84c927ad8d76f6afbd3f8fa653a70f744927517249fda132767ca715

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\A28EC\CCB4.28E
                                                                                                                                                          Filesize

                                                                                                                                                          996B

                                                                                                                                                          MD5

                                                                                                                                                          4e2fd9598d45d59e1c051852e0208ed2

                                                                                                                                                          SHA1

                                                                                                                                                          dc0c554e9d1363fca07a16e2dba7f542f7926b92

                                                                                                                                                          SHA256

                                                                                                                                                          a45d1dd936451052e4f32cc9213ac543afefac31c04e232b245596168d4e0cf2

                                                                                                                                                          SHA512

                                                                                                                                                          a075516579e41b78d62ffae0f52c98f96edda7d80c130385ccfa8654833606225aeb1d0bcd426d02d05c360d43e203fc60a02cd387dda50a958209ba92c431da

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\A28EC\CCB4.28E
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          cbd18cd282805c6d998069ae89d8e139

                                                                                                                                                          SHA1

                                                                                                                                                          b67fa18d3ea7ce72f7f6996e30b7f7f20037dc58

                                                                                                                                                          SHA256

                                                                                                                                                          2fb93d5ac88d09bb02000a81761a6fe723a93a711f15bc344e30d476421edf30

                                                                                                                                                          SHA512

                                                                                                                                                          07e99f024ff1ec29f2341e98bf2e2be7a3bf734c0103c0f854f53df5d9bea7cef4312e60b585b7a8ae37eaf8c5deb9c2399b65cc2d9bc2bb1bf4b9465f3ffb40

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\A28EC\CCB4.28E
                                                                                                                                                          Filesize

                                                                                                                                                          600B

                                                                                                                                                          MD5

                                                                                                                                                          ef5ee7b793e6ef145c73db6bfae9f54f

                                                                                                                                                          SHA1

                                                                                                                                                          bbd6be9758a9a580dec6700a62a409209269dad8

                                                                                                                                                          SHA256

                                                                                                                                                          f08c2bc0dd51305b058e81677b4f84f7632d656f6cadf9c752d0892d10c5ef71

                                                                                                                                                          SHA512

                                                                                                                                                          70a0d519a4a6748700c0561ec8691edf58752f2a13e51345d788e24d54fe798dd6a59835a94519c6937bb64dd076d6e0d49d9d6df25d47329a303adc2d524072

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\A28EC\CCB4.28E
                                                                                                                                                          Filesize

                                                                                                                                                          300B

                                                                                                                                                          MD5

                                                                                                                                                          38d17a69aae8f671b0d42b383fdf3ffe

                                                                                                                                                          SHA1

                                                                                                                                                          31c9da5b59f0b53855445c01fa034fa52c1b1af9

                                                                                                                                                          SHA256

                                                                                                                                                          ac171791af46379109ed50ce3d897df730a7876fb78b26396572fd42003ea813

                                                                                                                                                          SHA512

                                                                                                                                                          0bd759fc0c539ac1672151b33677aaaaebe7203627a86d8beb276908975f133447123162185007c17ab01447d9cff8ae963d69367da3ccaa53dd555a488f9942

                                                                                                                                                          Download Submit

                                                                                                                                                        • memory/532-409-0x000002B57B760000-0x000002B57B780000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/532-413-0x000002B57BB20000-0x000002B57BB40000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/532-411-0x000002B57B720000-0x000002B57B740000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/536-435-0x0000025779D90000-0x0000025779DB0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/536-437-0x0000025779D50000-0x0000025779D70000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/536-439-0x000002577A160000-0x000002577A180000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/756-578-0x000002B3836D0000-0x000002B3836F0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/756-583-0x000002B383AA0000-0x000002B383AC0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/756-580-0x000002B383690000-0x000002B3836B0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1216-38-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1216-39-0x0000000000840000-0x0000000000940000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1216-361-0x0000000000840000-0x0000000000940000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1364-147-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1364-146-0x0000000000550000-0x0000000000650000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1364-145-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1544-319-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1756-620-0x00000000027F0000-0x00000000027F1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2092-530-0x000002F719FB0000-0x000002F719FD0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2092-532-0x000002F719F70000-0x000002F719F90000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2092-535-0x000002F71A380000-0x000002F71A3A0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2396-509-0x000001CD29F00000-0x000001CD29F20000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2396-511-0x000001CD2A300000-0x000001CD2A320000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2396-506-0x000001CD29F40000-0x000001CD29F60000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3360-401-0x0000000004430000-0x0000000004431000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3424-385-0x000001CD4AD60000-0x000001CD4AD80000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3424-383-0x000001CD4A950000-0x000001CD4A970000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3424-381-0x000001CD4A990000-0x000001CD4A9B0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3548-452-0x0000000004070000-0x0000000004071000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3636-373-0x0000000000E60000-0x0000000000E61000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3708-557-0x000002A5D8420000-0x000002A5D8440000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3708-553-0x000002A5D8060000-0x000002A5D8080000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3708-555-0x000002A5D8020000-0x000002A5D8040000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3712-606-0x00000184505C0000-0x00000184505E0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3712-608-0x00000184509D0000-0x00000184509F0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3712-604-0x0000018450600000-0x0000018450620000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4068-342-0x00000000030F0000-0x00000000030F1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4320-595-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4328-522-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4340-520-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4340-143-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4340-36-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4340-2-0x0000000000640000-0x0000000000740000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4340-399-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4340-203-0x0000000000640000-0x0000000000740000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4340-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          428KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4344-350-0x000001EE46170000-0x000001EE46190000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4344-352-0x000001EE46130000-0x000001EE46150000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4344-355-0x000001EE46540000-0x000001EE46560000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4424-570-0x00000000044C0000-0x00000000044C1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4456-632-0x00000202E61E0000-0x00000202E6200000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4456-630-0x00000202E5BD0000-0x00000202E5BF0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4456-628-0x00000202E5E20000-0x00000202E5E40000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4776-462-0x0000013F0CD50000-0x0000013F0CD70000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4776-460-0x0000013F0CD90000-0x0000013F0CDB0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4776-464-0x0000013F0D160000-0x0000013F0D180000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4856-427-0x0000000003250000-0x0000000003251000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4924-486-0x000002E68A560000-0x000002E68A580000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4924-484-0x000002E68A150000-0x000002E68A170000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4924-482-0x000002E68A190000-0x000002E68A1B0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4956-545-0x00000000034C0000-0x00000000034C1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5216-329-0x000001F56CB60000-0x000001F56CB80000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5216-327-0x000001F56C750000-0x000001F56C770000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5216-325-0x000001F56C790000-0x000001F56C7B0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5264-475-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5656-498-0x0000000004760000-0x0000000004761000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5844-396-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          112KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5844-397-0x0000000000590000-0x0000000000690000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5844-398-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          112KB

                                                                                                                                                          Download