Overview

overview

8

Static

static

1

Valorant O...ch.zip

windows7-x64

1

Valorant O...ch.zip

windows10-2004-x64

1

Valorant O...T).lnk

windows7-x64

1

Valorant O...T).lnk

windows10-2004-x64

1

Valorant O...e).cmd

windows7-x64

1

Valorant O...e).cmd

windows10-2004-x64

1

Valorant O...es.cmd

windows7-x64

7

Valorant O...es.cmd

windows10-2004-x64

7

Valorant O...es.cmd

windows7-x64

7

Valorant O...es.cmd

windows10-2004-x64

1

Valorant O...he.bat

windows7-x64

8

Valorant O...he.bat

windows10-2004-x64

8

Valorant O...he.cmd

windows7-x64

1

Valorant O...he.cmd

windows10-2004-x64

1

Valorant O...Up.lnk

windows7-x64

7

Valorant O...Up.lnk

windows10-2004-x64

7

Analysis

  • max time kernel
    74s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/02/2024, 09:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Thumbnail Cache.bat

  • Size

    232B

  • MD5

    5887f03adc7ffe40769d0246d457531d

  • SHA1

    6681f82771048fb0ae405c02c7d8a06f08d77a4c

  • SHA256

    4bf7497786206040924db5f8c2ee75b9466676a115c169657f620c287a92ae20

  • SHA512

    2cfc53921eca548df790dc98f8622c9a322139f280a39c58e503b42b6000864f329632af42155af495363eefd75a67961a2e97f6336925767f4a6cf5e98341c0

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 16 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 32 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Valorant Optimization Pack - OGTech\4. Clean-Ups\Delete Thumbnail Cache.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Windows\system32\timeout.exe
      timeout 2 /nobreak
      2⤵
      • Delays execution with timeout.exe
      PID:1616
    • C:\Windows\system32\timeout.exe
      timeout 2 /nobreak
      2⤵
      • Delays execution with timeout.exe
      PID:3968
    • C:\Windows\explorer.exe
      explorer.exe
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:316
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4728
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2388
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3860
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2908
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4304
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:816
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:4032
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4852
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3868
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4256
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3936
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1364
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:856
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5020
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:2684
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4188
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4560
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3696
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1480
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4960
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3044
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3096
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3944
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2920
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:4184
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4140
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5100
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:3984
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          PID:4188
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1880
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4900
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:708
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1664
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:4908
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:508
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              PID:852
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4344
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4696
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                PID:5004
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:1328
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:2520
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                PID:1648
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1824
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:452
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3696
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1424
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4180
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:660
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4956
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Installed Components in the registry
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            PID:1664
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:332
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:968
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3656
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4960
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3460
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:1740
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2208
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3924
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4428
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:540
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3024
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4356
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3912
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4720
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3544
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3088
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:2216
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:816
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2180
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3468
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                    • Modifies registry class
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1824
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4524
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4304
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:1684
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2644
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:1376
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4832
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:776
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2160
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4152
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:5092
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3372
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:436
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4088
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4068
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3184
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3256
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4652
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4216

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        MD5

                                                                                                        ad5c5c3fd1040c8d99b2d97b79831e01

                                                                                                        SHA1

                                                                                                        d5da5a5172c71d7c908bcc2c946cd58d634cbf4b

                                                                                                        SHA256

                                                                                                        b2e05235916b51f623f86ec1a6fec86207299b37539b384888fcdd9ed005fab3

                                                                                                        SHA512

                                                                                                        673163698a11ebc77bee1c1e402f0db188fcf381a9a6f21cafe3434db2ece4a9e0befe544f6ff6a0595b571533de81bb498574d3f2fa7917475962c2f39744ee

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                                        Filesize

                                                                                                        24B

                                                                                                        MD5

                                                                                                        ae6fbded57f9f7d048b95468ddee47ca

                                                                                                        SHA1

                                                                                                        c4473ea845be2fb5d28a61efd72f19d74d5fc82e

                                                                                                        SHA256

                                                                                                        d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

                                                                                                        SHA512

                                                                                                        f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        c2445a9092591c5262dfa12d74357c83

                                                                                                        SHA1

                                                                                                        22ea3b0bfb2d24aacdb1cd43f57a0e08a404ed52

                                                                                                        SHA256

                                                                                                        c96cb4377ae311651bb0c81b2e54c3181a225b0b92da40595dcf7cde6648e446

                                                                                                        SHA512

                                                                                                        5f37a1a304a43816f823e1c622a0810e2f560b5be6edb159b6a4ca9dfd057cadaf5508d557006a18e824661bc63e8890b101ba84ee3f82b298d71d7820e6b481

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                        Filesize

                                                                                                        7KB

                                                                                                        MD5

                                                                                                        f2eaff7ec99db1525d1c86c19bc8c66f

                                                                                                        SHA1

                                                                                                        b0f48b9d7dae4cbb4a9f275d46a54bb67429bc2e

                                                                                                        SHA256

                                                                                                        e987a8a4e7290089639aa95cba176d76708415a5e829e19690b81992c3a6fd53

                                                                                                        SHA512

                                                                                                        699b0da30a55d95004c1fb02beed306e5b2005571909f8d312770891a362d9e66a6e45aeded66ee1ea36b35a471d93a5af1d41f1adaab1a073ef3858fc1a150b

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\UR6ZQLG1\microsoft.windows[1].xml
                                                                                                        Filesize

                                                                                                        97B

                                                                                                        MD5

                                                                                                        dd307e3962c08e3c197c23ae1d9b0139

                                                                                                        SHA1

                                                                                                        ecf6cb6157602f40b748f95f47cb4eb064f21efd

                                                                                                        SHA256

                                                                                                        a272239f0b6b0c8306dc5c02e6283c244c5bf19678f15949ac6fef249ab9b8e8

                                                                                                        SHA512

                                                                                                        04aa7ab4e8bec2a3b5bb77515a915f00bf2bf0545fa015b0bdf530be535f13a067f2cc6a9c76b64c0e67a69f39a5b01a4b212ec45a733242c687febf9e2dbcf7

                                                                                                        Download Submit

                                                                                                      • memory/332-397-0x00000000046E0000-0x00000000046E1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/452-338-0x000001CFC3F40000-0x000001CFC3F60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/452-336-0x000001CFC3F80000-0x000001CFC3FA0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/452-340-0x000001CFC4350000-0x000001CFC4370000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/508-267-0x000001B9F7090000-0x000001B9F70B0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/508-269-0x000001B9F7050000-0x000001B9F7070000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/508-271-0x000001B9F7660000-0x000001B9F7680000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/660-374-0x0000000004420000-0x0000000004421000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/816-73-0x0000023AC6F30000-0x0000023AC6F50000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/816-71-0x0000023AC6B20000-0x0000023AC6B40000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/816-69-0x0000023AC6B60000-0x0000023AC6B80000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/852-282-0x0000000004310000-0x0000000004311000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/856-127-0x00000000044F0000-0x00000000044F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/1364-113-0x0000020F4A7C0000-0x0000020F4A7E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1364-115-0x0000020F4A780000-0x0000020F4A7A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1364-118-0x0000020F4AB90000-0x0000020F4ABB0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1480-169-0x0000000003F90000-0x0000000003F91000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/1648-328-0x0000000004210000-0x0000000004211000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/1664-386-0x000001B2E4B10000-0x000001B2E4B30000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1664-384-0x000001B2E4700000-0x000001B2E4720000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1664-382-0x000001B2E4740000-0x000001B2E4760000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1664-260-0x0000000004380000-0x0000000004381000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/1880-243-0x0000022C22540000-0x0000022C22560000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1880-246-0x0000022C22900000-0x0000022C22920000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1880-245-0x0000022C22500000-0x0000022C22520000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2520-315-0x0000017698C30000-0x0000017698C50000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2520-313-0x0000017698C70000-0x0000017698C90000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2520-317-0x0000017699040000-0x0000017699060000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2684-135-0x000001D6852D0000-0x000001D6852F0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2684-137-0x000001D685290000-0x000001D6852B0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2684-139-0x000001D6858A0000-0x000001D6858C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2908-63-0x0000000002A80000-0x0000000002A81000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2920-202-0x000001E0F1530000-0x000001E0F1550000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2920-200-0x000001E0F1570000-0x000001E0F1590000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/2920-204-0x000001E0F1940000-0x000001E0F1960000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3044-179-0x00000230852A0000-0x00000230852C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3044-181-0x00000230858C0000-0x00000230858E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3044-177-0x00000230852E0000-0x0000023085300000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3096-192-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/3656-405-0x000001F2DC9F0000-0x000001F2DCA10000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3656-407-0x000001F2DC9B0000-0x000001F2DC9D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3656-409-0x000001F2DCDC0000-0x000001F2DCDE0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3696-155-0x000002534EDA0000-0x000002534EDC0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3696-159-0x000002534F170000-0x000002534F190000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3696-352-0x0000000004170000-0x0000000004171000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/3696-157-0x000002534ED60000-0x000002534ED80000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3868-94-0x000001EC00400000-0x000001EC00420000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3868-91-0x000001EC00000000-0x000001EC00020000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3868-89-0x000001EC00040000-0x000001EC00060000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3984-236-0x00000000045F0000-0x00000000045F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4032-81-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4180-359-0x0000024DC8620000-0x0000024DC8640000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4180-361-0x0000024DC83D0000-0x0000024DC83F0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4180-363-0x0000024DC89E0000-0x0000024DC8A00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4184-212-0x0000000004300000-0x0000000004301000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4188-147-0x0000000004520000-0x0000000004521000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4256-105-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4696-294-0x000002525ACE0000-0x000002525AD00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4696-292-0x000002525A6C0000-0x000002525A6E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4696-290-0x000002525A700000-0x000002525A720000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/5004-306-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/5100-225-0x000001AB5B010000-0x000001AB5B030000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/5100-222-0x000001AB5AC00000-0x000001AB5AC20000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/5100-220-0x000001AB5AC40000-0x000001AB5AC60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download