Overview

overview

10

Static

static

3

117a962cde...f1.exe

windows7-x64

10

117a962cde...f1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    83s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 09:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    117a962cde2568514649b76a004190f1.exe

  • Size

    259KB

  • MD5

    117a962cde2568514649b76a004190f1

  • SHA1

    e92ab6267e005eb78bac3c13b9de881b726bc7f2

  • SHA256

    8dec86d0a0c4034b6d688a0610742694517e0d31939c53db11b898c0ba7315c0

  • SHA512

    a2eb2cd551bea8eead2cc7cf17dd91849395c475f329e9bd47ff4ebab8aff0c9a1e33921e4fc6af9ca762b6c80c48056b8991f8813b7e19a7eca4dfb0914041d

  • SSDEEP

    3072:15QiI6J/iVo/QgheGRdWfPy0R9gSMGFwLh4+giekZXfSg55xGT+yx:1gVo/Qgp+lR9g+OhlRR9qwxGT

Score
10/10
amadeydcratdjvugluptebalummasmokeloaderpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratstealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .lkhy

  • offline_id

    OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdw

rsa_pubkey.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat 4 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 11 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\117a962cde2568514649b76a004190f1.exe
    "C:\Users\Admin\AppData\Local\Temp\117a962cde2568514649b76a004190f1.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1544
  • C:\Users\Admin\AppData\Local\Temp\BA47.exe
    C:\Users\Admin\AppData\Local\Temp\BA47.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\BA47.exe
      C:\Users\Admin\AppData\Local\Temp\BA47.exe
      2⤵
      • DcRat
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\287cc41b-ea65-466b-b8cd-7c870b54ed2c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:1108
      • C:\Users\Admin\AppData\Local\Temp\BA47.exe
        "C:\Users\Admin\AppData\Local\Temp\BA47.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Users\Admin\AppData\Local\Temp\BA47.exe
          "C:\Users\Admin\AppData\Local\Temp\BA47.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:3432
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 568
            5⤵
            • Program crash
            PID:3556
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 212 -p 3432 -ip 3432
    1⤵
      PID:4888
    • C:\Users\Admin\AppData\Local\Temp\FBA7.exe
      C:\Users\Admin\AppData\Local\Temp\FBA7.exe
      1⤵
      • Executes dropped EXE
      PID:2144
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF42.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:1932
      • C:\Users\Admin\AppData\Local\Temp\780.exe
        C:\Users\Admin\AppData\Local\Temp\780.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3340
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4216
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 2580
            3⤵
            • Program crash
            PID:1436
        • C:\Users\Admin\AppData\Local\Temp\780.exe
          "C:\Users\Admin\AppData\Local\Temp\780.exe"
          2⤵
          • Executes dropped EXE
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:376
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
              PID:4700
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4872
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                4⤵
                • Modifies Windows Firewall
                PID:4136
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
                PID:1272
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                3⤵
                  PID:2612
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  3⤵
                    PID:4460
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                        PID:4468
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        4⤵
                        • DcRat
                        • Creates scheduled task(s)
                        PID:844
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn ScheduledUpdate /f
                        4⤵
                          PID:4116
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                            PID:1860
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            4⤵
                              PID:3416
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              4⤵
                                PID:4052
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                4⤵
                                • DcRat
                                • Creates scheduled task(s)
                                PID:4560
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                4⤵
                                  PID:3472
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                    5⤵
                                      PID:3580
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                        6⤵
                                        • Launches sc.exe
                                        PID:3604
                            • C:\Users\Admin\AppData\Local\Temp\11E1.exe
                              C:\Users\Admin\AppData\Local\Temp\11E1.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3816
                            • C:\Users\Admin\AppData\Local\Temp\1B48.exe
                              C:\Users\Admin\AppData\Local\Temp\1B48.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Drops file in Windows directory
                              PID:4356
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:4904
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4216 -ip 4216
                              1⤵
                                PID:3164
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:2380
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Enumerates connected drives
                                • Checks SCSI registry key(s)
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:4568
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:4456
                              • C:\Users\Admin\AppData\Roaming\assivww
                                C:\Users\Admin\AppData\Roaming\assivww
                                1⤵
                                • Executes dropped EXE
                                PID:1464
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                PID:5036
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Enumerates connected drives
                                • Modifies registry class
                                • Suspicious use of SendNotifyMessage
                                PID:2308
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4700
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3948
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:2628
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4972
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:4432
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2572
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1268
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:5044
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4300
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:2232
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:544
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1760
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4324
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3468
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3116
                                                          • C:\Windows\windefender.exe
                                                            C:\Windows\windefender.exe
                                                            1⤵
                                                              PID:1964
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2300
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1300
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3928
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:4540
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3636
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4208
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:428
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:1644
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4240
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1816
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:544

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Reconnaissance

                                                                                  Resource Development

                                                                                  Initial Access

                                                                                  Execution

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Persistence

                                                                                  Boot or Logon Autostart Execution

                                                                                  2
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  2
                                                                                  T1547.001

                                                                                  Create or Modify System Process

                                                                                  1
                                                                                  T1543

                                                                                  Windows Service

                                                                                  1
                                                                                  T1543.003

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Privilege Escalation

                                                                                  Boot or Logon Autostart Execution

                                                                                  2
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  2
                                                                                  T1547.001

                                                                                  Create or Modify System Process

                                                                                  1
                                                                                  T1543

                                                                                  Windows Service

                                                                                  1
                                                                                  T1543.003

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Defense Evasion

                                                                                  File and Directory Permissions Modification

                                                                                  1
                                                                                  T1222

                                                                                  Impair Defenses

                                                                                  1
                                                                                  T1562

                                                                                  Disable or Modify System Firewall

                                                                                  1
                                                                                  T1562.004

                                                                                  Modify Registry

                                                                                  3
                                                                                  T1112

                                                                                  Virtualization/Sandbox Evasion

                                                                                  2
                                                                                  T1497

                                                                                  Credential Access

                                                                                  Discovery

                                                                                  Peripheral Device Discovery

                                                                                  2
                                                                                  T1120

                                                                                  Query Registry

                                                                                  7
                                                                                  T1012

                                                                                  System Information Discovery

                                                                                  6
                                                                                  T1082

                                                                                  Virtualization/Sandbox Evasion

                                                                                  2
                                                                                  T1497

                                                                                  Lateral Movement

                                                                                  Collection

                                                                                  Command and Control

                                                                                  Exfiltration

                                                                                  Impact

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\39XIXV5T\microsoft.windows[1].xml
                                                                                    Filesize

                                                                                    96B

                                                                                    MD5

                                                                                    29e3c94dfa03b794f03e17d8b45295d9

                                                                                    SHA1

                                                                                    1a598a72d3d486f77e861f98abcd2f4a8e936365

                                                                                    SHA256

                                                                                    7ff0263086f28cc1d842d07a23128b955780d3c8b85b130228c7f65ce2b4262a

                                                                                    SHA512

                                                                                    e2180d73f45da32ac4fb355546103496d73cdf7cb966c60f6a414bc7052e46431177e9009bdfd730d2fe6955b986392720fe3bdc8afbc0388f1b70e438a4ef9c

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                                                    Filesize

                                                                                    704KB

                                                                                    MD5

                                                                                    eb36bc1f608b4510cf76240c646882f4

                                                                                    SHA1

                                                                                    6addaadbd8cb3fcc141dab842d9fb63ec2cccb3e

                                                                                    SHA256

                                                                                    cbf04bfdd70e53f9209950aa1dcea96267e96c27359756c06255594a631d6f34

                                                                                    SHA512

                                                                                    1f227ac293a439a14ee0df1cde97572233b3ec2e3fdf5e81fbd73f22b0a57ed001406067eafc44b0075d88430b515e3c971df73d6ff814a8a1c6f0df2892ba9f

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\11E1.exe
                                                                                    Filesize

                                                                                    11.8MB

                                                                                    MD5

                                                                                    450039a02217c53bd983eaf1fd34505a

                                                                                    SHA1

                                                                                    930ed58a2f58ca7bf3e39aaee43fb541f1c6eeda

                                                                                    SHA256

                                                                                    d2eacbc922f248856b860aa7c31476ae4123f97e82cf69760ef216d9dca321f0

                                                                                    SHA512

                                                                                    cf37a82ea7b64f4633ac82c73feff3f829dda279a7caeac32a4cde7b0f82a43b37f67e620677a87d2eccc0eee6f8d68d0175a086487b2174b4f30b66aa4fb080

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1B48.exe
                                                                                    Filesize

                                                                                    1.2MB

                                                                                    MD5

                                                                                    765a166abf8a52482a531f4c5b85cd98

                                                                                    SHA1

                                                                                    2d8cf7ce37802f11c6f740251ed9ba08a4863bb7

                                                                                    SHA256

                                                                                    30ada755dc23f03935169bd9e70420ef532d9d49d18598bfa1f34e2743d75d95

                                                                                    SHA512

                                                                                    2f9fd2ad657245d14be6438ed86475cdb9e34a68a609c2f6785ef26ffc7b500140e9fde417cc85c006da9b44b69d3f79a79bfa38daa45309e866a3f268910101

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\1B48.exe
                                                                                    Filesize

                                                                                    960KB

                                                                                    MD5

                                                                                    298d8cc160bfd0ed0d3e042749a2de4b

                                                                                    SHA1

                                                                                    2330020ba055181737313b7a13d4cddce4c34dc7

                                                                                    SHA256

                                                                                    6184d6f6747333a500fe51e1f6006f1beecd76f5764b03452b73c9c5560f474c

                                                                                    SHA512

                                                                                    03903cd5ecae7bc2c7d1e75733d8012a0d0719dd113aadec55aa18f1cbb4cdb84637491e6b23c7f718312d3d21b536f90226d57faeaa286ec4102c0ca7c33d22

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\780.exe
                                                                                    Filesize

                                                                                    4.1MB

                                                                                    MD5

                                                                                    5c829441a341d8eed9d445081e889d52

                                                                                    SHA1

                                                                                    c281d3934466c592eca5f712b18f3e83fabcbbf6

                                                                                    SHA256

                                                                                    934b7cbd70c39bcdfaba46448139c74b5343e9663efc2c9f2dfb16893eca24f5

                                                                                    SHA512

                                                                                    ae061c786c0ba9e451c620dfcf30bf9fea566c722dca458dc24b1a686d60ae40900941b512ae92e407f7a33e64c6348bf9b2404b7a8c4964a5395bfb37c36d45

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\BA47.exe
                                                                                    Filesize

                                                                                    700KB

                                                                                    MD5

                                                                                    ac282e0c3008238e949df7acf56bd7e7

                                                                                    SHA1

                                                                                    3f27bf2d71cb268636064ae950a2f14ea2df3433

                                                                                    SHA256

                                                                                    4f0fea97eaf9353a2ce670fa8f46a72d3937edf86a090941b2d15487b43254bf

                                                                                    SHA512

                                                                                    93609e746c9a806ab5fddf50c7df44d00d069ce585e0105d305d83848735db1d905c5b38ca3d273e33a3585a4e5a61a0e38def517fd67b8209bea6406e05bc01

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\FBA7.exe
                                                                                    Filesize

                                                                                    5.5MB

                                                                                    MD5

                                                                                    d689d942a645a468007b85fdf9413de9

                                                                                    SHA1

                                                                                    c94e0a7ff515c05a73048f3c6d2dd0c95071c4b6

                                                                                    SHA256

                                                                                    82177bd7ae6c995aa53d63d21e5c53883af16f3b84832d5557fe3dfce3cf58cd

                                                                                    SHA512

                                                                                    525184773ae2e1642e05bee15b58457a995a3225f417a8b26580d306bd292ab880d9768187b6e5c144bf9d4eb3f95f2a2b82f7402eb11b3239740f5412f7608c

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\FF42.bat
                                                                                    Filesize

                                                                                    77B

                                                                                    MD5

                                                                                    55cc761bf3429324e5a0095cab002113

                                                                                    SHA1

                                                                                    2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                    SHA256

                                                                                    d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                    SHA512

                                                                                    33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2yjusrso.wy2.ps1
                                                                                    Filesize

                                                                                    60B

                                                                                    MD5

                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                    SHA1

                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                    SHA256

                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                    SHA512

                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                    Filesize

                                                                                    281KB

                                                                                    MD5

                                                                                    d98e33b66343e7c96158444127a117f6

                                                                                    SHA1

                                                                                    bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                    SHA256

                                                                                    5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                    SHA512

                                                                                    705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Roaming\assivww
                                                                                    Filesize

                                                                                    259KB

                                                                                    MD5

                                                                                    117a962cde2568514649b76a004190f1

                                                                                    SHA1

                                                                                    e92ab6267e005eb78bac3c13b9de881b726bc7f2

                                                                                    SHA256

                                                                                    8dec86d0a0c4034b6d688a0610742694517e0d31939c53db11b898c0ba7315c0

                                                                                    SHA512

                                                                                    a2eb2cd551bea8eead2cc7cf17dd91849395c475f329e9bd47ff4ebab8aff0c9a1e33921e4fc6af9ca762b6c80c48056b8991f8813b7e19a7eca4dfb0914041d

                                                                                    Download Submit

                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    968cb9309758126772781b83adb8a28f

                                                                                    SHA1

                                                                                    8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                                                    SHA256

                                                                                    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                                                    SHA512

                                                                                    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                                                    Download Submit

                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                    Filesize

                                                                                    19KB

                                                                                    MD5

                                                                                    a91a7e5241dbadd09db530d2ac64124e

                                                                                    SHA1

                                                                                    08bde701c20357c3fe26365e0e80f68564eb23d0

                                                                                    SHA256

                                                                                    ddb3c9698f3059acd67ac5de3aab01de40384898fabb7295a73d6bc19e9f29a0

                                                                                    SHA512

                                                                                    ab13b7fdcc411f88c651b2b4cee07aaaa5ba7d06a582c235def0c01865f7bb978db9757720c940832c4e975ab052579008ca40972f1821d8298c16dbe27fb0b2

                                                                                    Download Submit

                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                    Filesize

                                                                                    19KB

                                                                                    MD5

                                                                                    c7381526868fac29590372dfab67d61c

                                                                                    SHA1

                                                                                    57abe9ecdfd6e941c267232b20627a0d9246c888

                                                                                    SHA256

                                                                                    ddc6faf5ba1dfe4f0d51038c76d08ea8496f1b99b0824264554380714583c7f4

                                                                                    SHA512

                                                                                    4794733f4f3a3cae8a0d5735ec22a4ccd3effebbffc6b2b87783310ee4f3a86fda7ee8d1987c6b7b7a6c5d945123076b1c3a5941c567440549474f5853c46784

                                                                                    Download Submit

                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                    Filesize

                                                                                    19KB

                                                                                    MD5

                                                                                    f2dfa98e40494d5f827d3f9dd2b41461

                                                                                    SHA1

                                                                                    815f2936d03979bb2ba2250e23e9049b3870de55

                                                                                    SHA256

                                                                                    3166035333f1db38c2b52b38bf2434c546ed0ad8f40239f5ccf1b0a7852ba160

                                                                                    SHA512

                                                                                    fc8819578fd3e79237c0eb934784d861668f6d8fb0534e7cb941fe621a05e3739f0503e3e49ade56cffe6a3b8aa4c3f1ba69a9c2dfe291ee2ed0c6000a935323

                                                                                    Download Submit

                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                    Filesize

                                                                                    19KB

                                                                                    MD5

                                                                                    cdf8970c475e288aec437f87deda7762

                                                                                    SHA1

                                                                                    d4d4a68db422c260d42bdffd4a85d2641b710816

                                                                                    SHA256

                                                                                    b177a4467b96d2c0d863172f20ccf9131e842336d3be938e227e266df8ba37ea

                                                                                    SHA512

                                                                                    ac6fca49291e3c10ef171e5873d58d1e89512f906a1b4d6afb0bf08e11689d54079362076a2b8f28c61e2de993bcd85c5ea0a0a120d5cf5a0056497c4ece4ed2

                                                                                    Download Submit

                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                    Filesize

                                                                                    19KB

                                                                                    MD5

                                                                                    7c69de714c3ce5eb0cc5c734a0edb651

                                                                                    SHA1

                                                                                    7405dc8a85bf83aca0ce82aa58757d91593d5980

                                                                                    SHA256

                                                                                    584525e4f51f5d6bff866e4384dd4bacf8821862ef610cee261bc12cb020b599

                                                                                    SHA512

                                                                                    53651776f8145e5942f7c52e36d005bee2364712d2a94b8cba143835390227cee7bc033204b244af2d6a788fdf132a585de8e5f26a24a55750110db869d9729d

                                                                                    Download Submit

                                                                                  • C:\Windows\rss\csrss.exe
                                                                                    Filesize

                                                                                    960KB

                                                                                    MD5

                                                                                    5266071c933122f9c408e160ef434196

                                                                                    SHA1

                                                                                    44d7e5e29ee21132a7db908e756a43a685df4e08

                                                                                    SHA256

                                                                                    0f7e3454607dfb099f2c6b238d0d95d5c2208515c9c563d71d345507bca9201e

                                                                                    SHA512

                                                                                    ec098f12c18a3442e7e276cbaf0552f2e752b6935981e47b5227a8b895352357fb49ae1fa2ebd232d092a6afa5126455336574ece0761045ea72717a9553af5c

                                                                                    Download Submit

                                                                                  • C:\Windows\rss\csrss.exe
                                                                                    Filesize

                                                                                    869KB

                                                                                    MD5

                                                                                    f8cae0b7609a2384818e45668424c685

                                                                                    SHA1

                                                                                    8721034e86cb2a0bdde2610653e1def6aa8462fc

                                                                                    SHA256

                                                                                    b5b35da51f309e5bb9f75ca8a4c73e32fbc8053c94a86b05f2498fbb9ea35f69

                                                                                    SHA512

                                                                                    b98e8e009a2606ae4cd16e534c9d3e953a6110167bc1dd676b642b55c78a0df638a0b0276ea04de4e81c64775f648ea3b1a3973094f12359e60a03f2d4a109a2

                                                                                    Download Submit

                                                                                  • C:\Windows\windefender.exe
                                                                                    Filesize

                                                                                    2.0MB

                                                                                    MD5

                                                                                    8e67f58837092385dcf01e8a2b4f5783

                                                                                    SHA1

                                                                                    012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                    SHA256

                                                                                    166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                    SHA512

                                                                                    40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                                    Download Submit

                                                                                  • memory/376-287-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/376-209-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/376-147-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/376-146-0x0000000004660000-0x0000000004A61000-memory.dmp

                                                                                    Filesize

                                                                                    4.0MB

                                                                                    Download

                                                                                  • memory/544-426-0x0000020494570000-0x0000020494590000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/544-429-0x0000020494980000-0x00000204949A0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/544-424-0x00000204945B0000-0x00000204945D0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1464-260-0x0000000000400000-0x0000000001A2D000-memory.dmp

                                                                                    Filesize

                                                                                    22.2MB

                                                                                    Download

                                                                                  • memory/1464-277-0x0000000000400000-0x0000000001A2D000-memory.dmp

                                                                                    Filesize

                                                                                    22.2MB

                                                                                    Download

                                                                                  • memory/1512-20-0x00000000041B0000-0x00000000042CB000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                    Download

                                                                                  • memory/1512-16-0x0000000004030000-0x00000000040CA000-memory.dmp

                                                                                    Filesize

                                                                                    616KB

                                                                                    Download

                                                                                  • memory/1544-3-0x0000000003630000-0x000000000363B000-memory.dmp

                                                                                    Filesize

                                                                                    44KB

                                                                                    Download

                                                                                  • memory/1544-1-0x0000000001A90000-0x0000000001B90000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1544-2-0x0000000000400000-0x0000000001A2D000-memory.dmp

                                                                                    Filesize

                                                                                    22.2MB

                                                                                    Download

                                                                                  • memory/1544-5-0x0000000000400000-0x0000000001A2D000-memory.dmp

                                                                                    Filesize

                                                                                    22.2MB

                                                                                    Download

                                                                                  • memory/1760-440-0x0000000004400000-0x0000000004401000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/2144-53-0x0000000001160000-0x0000000001161000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/2144-49-0x0000000000300000-0x0000000000BF1000-memory.dmp

                                                                                    Filesize

                                                                                    8.9MB

                                                                                    Download

                                                                                  • memory/2144-48-0x0000000001150000-0x0000000001151000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/2144-84-0x0000000000300000-0x0000000000BF1000-memory.dmp

                                                                                    Filesize

                                                                                    8.9MB

                                                                                    Download

                                                                                  • memory/2144-51-0x0000000000300000-0x0000000000BF1000-memory.dmp

                                                                                    Filesize

                                                                                    8.9MB

                                                                                    Download

                                                                                  • memory/2572-354-0x00000000014D0000-0x00000000014D1000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/2628-274-0x0000000007310000-0x0000000007326000-memory.dmp

                                                                                    Filesize

                                                                                    88KB

                                                                                    Download

                                                                                  • memory/3340-116-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/3340-69-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/3340-143-0x0000000004810000-0x00000000050FB000-memory.dmp

                                                                                    Filesize

                                                                                    8.9MB

                                                                                    Download

                                                                                  • memory/3340-142-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/3340-63-0x0000000004410000-0x000000000480D000-memory.dmp

                                                                                    Filesize

                                                                                    4.0MB

                                                                                    Download

                                                                                  • memory/3340-65-0x0000000004810000-0x00000000050FB000-memory.dmp

                                                                                    Filesize

                                                                                    8.9MB

                                                                                    Download

                                                                                  • memory/3432-38-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/3432-39-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/3432-41-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/3460-4-0x00000000030C0000-0x00000000030D6000-memory.dmp

                                                                                    Filesize

                                                                                    88KB

                                                                                    Download

                                                                                  • memory/3460-111-0x00000000011F0000-0x00000000011F1000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3468-448-0x000001D67D000000-0x000001D67D020000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/3660-35-0x0000000004080000-0x000000000411F000-memory.dmp

                                                                                    Filesize

                                                                                    636KB

                                                                                    Download

                                                                                  • memory/3816-129-0x00007FF756940000-0x00007FF7575A2000-memory.dmp

                                                                                    Filesize

                                                                                    12.4MB

                                                                                    Download

                                                                                  • memory/3816-144-0x00007FF756940000-0x00007FF7575A2000-memory.dmp

                                                                                    Filesize

                                                                                    12.4MB

                                                                                    Download

                                                                                  • memory/3816-305-0x00007FF756940000-0x00007FF7575A2000-memory.dmp

                                                                                    Filesize

                                                                                    12.4MB

                                                                                    Download

                                                                                  • memory/3816-339-0x00007FF756940000-0x00007FF7575A2000-memory.dmp

                                                                                    Filesize

                                                                                    12.4MB

                                                                                    Download

                                                                                  • memory/3816-286-0x00007FF756940000-0x00007FF7575A2000-memory.dmp

                                                                                    Filesize

                                                                                    12.4MB

                                                                                    Download

                                                                                  • memory/3816-208-0x00007FF756940000-0x00007FF7575A2000-memory.dmp

                                                                                    Filesize

                                                                                    12.4MB

                                                                                    Download

                                                                                  • memory/3816-436-0x00007FF756940000-0x00007FF7575A2000-memory.dmp

                                                                                    Filesize

                                                                                    12.4MB

                                                                                    Download

                                                                                  • memory/4216-140-0x0000000074340000-0x0000000074AF0000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                    Download

                                                                                  • memory/4216-130-0x0000000007450000-0x000000000746E000-memory.dmp

                                                                                    Filesize

                                                                                    120KB

                                                                                    Download

                                                                                  • memory/4216-86-0x0000000074340000-0x0000000074AF0000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                    Download

                                                                                  • memory/4216-133-0x000000007F3E0000-0x000000007F3F0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                    Download

                                                                                  • memory/4216-132-0x0000000007470000-0x0000000007513000-memory.dmp

                                                                                    Filesize

                                                                                    652KB

                                                                                    Download

                                                                                  • memory/4216-134-0x0000000007560000-0x000000000756A000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                    Download

                                                                                  • memory/4216-107-0x0000000005EF0000-0x0000000005F3C000-memory.dmp

                                                                                    Filesize

                                                                                    304KB

                                                                                    Download

                                                                                  • memory/4216-87-0x0000000005090000-0x00000000056B8000-memory.dmp

                                                                                    Filesize

                                                                                    6.2MB

                                                                                    Download

                                                                                  • memory/4216-114-0x00000000078D0000-0x0000000007F4A000-memory.dmp

                                                                                    Filesize

                                                                                    6.5MB

                                                                                    Download

                                                                                  • memory/4216-106-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

                                                                                    Filesize

                                                                                    120KB

                                                                                    Download

                                                                                  • memory/4216-105-0x0000000005A10000-0x0000000005D64000-memory.dmp

                                                                                    Filesize

                                                                                    3.3MB

                                                                                    Download

                                                                                  • memory/4216-112-0x0000000006410000-0x0000000006454000-memory.dmp

                                                                                    Filesize

                                                                                    272KB

                                                                                    Download

                                                                                  • memory/4216-104-0x00000000059A0000-0x0000000005A06000-memory.dmp

                                                                                    Filesize

                                                                                    408KB

                                                                                    Download

                                                                                  • memory/4216-94-0x0000000005830000-0x0000000005896000-memory.dmp

                                                                                    Filesize

                                                                                    408KB

                                                                                    Download

                                                                                  • memory/4216-113-0x00000000071D0000-0x0000000007246000-memory.dmp

                                                                                    Filesize

                                                                                    472KB

                                                                                    Download

                                                                                  • memory/4216-88-0x0000000002540000-0x0000000002550000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                    Download

                                                                                  • memory/4216-85-0x0000000002900000-0x0000000002936000-memory.dmp

                                                                                    Filesize

                                                                                    216KB

                                                                                    Download

                                                                                  • memory/4216-89-0x0000000002540000-0x0000000002550000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                    Download

                                                                                  • memory/4216-119-0x0000000070340000-0x0000000070694000-memory.dmp

                                                                                    Filesize

                                                                                    3.3MB

                                                                                    Download

                                                                                  • memory/4216-91-0x0000000004DF0000-0x0000000004E12000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                    Download

                                                                                  • memory/4216-118-0x00000000701C0000-0x000000007020C000-memory.dmp

                                                                                    Filesize

                                                                                    304KB

                                                                                    Download

                                                                                  • memory/4216-117-0x0000000007410000-0x0000000007442000-memory.dmp

                                                                                    Filesize

                                                                                    200KB

                                                                                    Download

                                                                                  • memory/4216-115-0x0000000007270000-0x000000000728A000-memory.dmp

                                                                                    Filesize

                                                                                    104KB

                                                                                    Download

                                                                                  • memory/4300-416-0x0000000003F10000-0x0000000003F11000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-93-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-78-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-80-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-81-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-79-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-82-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-83-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-77-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-76-0x0000000000280000-0x0000000000723000-memory.dmp

                                                                                    Filesize

                                                                                    4.6MB

                                                                                    Download

                                                                                  • memory/4356-90-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4356-75-0x0000000077AD4000-0x0000000077AD6000-memory.dmp

                                                                                    Filesize

                                                                                    8KB

                                                                                    Download

                                                                                  • memory/4356-74-0x0000000000280000-0x0000000000723000-memory.dmp

                                                                                    Filesize

                                                                                    4.6MB

                                                                                    Download

                                                                                  • memory/4356-139-0x0000000000280000-0x0000000000723000-memory.dmp

                                                                                    Filesize

                                                                                    4.6MB

                                                                                    Download

                                                                                  • memory/4356-131-0x0000000000280000-0x0000000000723000-memory.dmp

                                                                                    Filesize

                                                                                    4.6MB

                                                                                    Download

                                                                                  • memory/4460-307-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/4460-435-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/4460-324-0x0000000000400000-0x00000000026BE000-memory.dmp

                                                                                    Filesize

                                                                                    34.7MB

                                                                                    Download

                                                                                  • memory/4568-183-0x0000000005130000-0x0000000005131000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4632-32-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/4632-21-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/4632-19-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/4632-17-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/4632-22-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    Download

                                                                                  • memory/4700-150-0x0000000000C90000-0x0000000000CA0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                    Download

                                                                                  • memory/4700-179-0x0000000006FC0000-0x0000000006FD1000-memory.dmp

                                                                                    Filesize

                                                                                    68KB

                                                                                    Download

                                                                                  • memory/4700-164-0x000000007F3F0000-0x000000007F400000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                    Download

                                                                                  • memory/4700-163-0x00000000706A0000-0x00000000706EC000-memory.dmp

                                                                                    Filesize

                                                                                    304KB

                                                                                    Download

                                                                                  • memory/4700-180-0x0000000007000000-0x000000000700E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                    Download

                                                                                  • memory/4700-148-0x0000000074790000-0x0000000074F40000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                    Download

                                                                                  • memory/4700-165-0x0000000070E30000-0x0000000071184000-memory.dmp

                                                                                    Filesize

                                                                                    3.3MB

                                                                                    Download

                                                                                  • memory/4700-161-0x0000000005B40000-0x0000000005B8C000-memory.dmp

                                                                                    Filesize

                                                                                    304KB

                                                                                    Download

                                                                                  • memory/4700-151-0x0000000005450000-0x00000000057A4000-memory.dmp

                                                                                    Filesize

                                                                                    3.3MB

                                                                                    Download

                                                                                  • memory/4700-149-0x0000000000C90000-0x0000000000CA0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                    Download

                                                                                  • memory/4700-178-0x00000000070A0000-0x0000000007136000-memory.dmp

                                                                                    Filesize

                                                                                    600KB

                                                                                    Download

                                                                                  • memory/4700-175-0x0000000006D70000-0x0000000006E13000-memory.dmp

                                                                                    Filesize

                                                                                    652KB

                                                                                    Download

                                                                                  • memory/5036-198-0x000001123DB80000-0x000001123DBA0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/5036-191-0x000001123D5A0000-0x000001123D5C0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/5036-193-0x000001123D560000-0x000001123D580000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/5044-369-0x000002DFED1B0000-0x000002DFED1D0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/5044-365-0x000002DFED170000-0x000002DFED190000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/5044-363-0x000002DFECDF0000-0x000002DFECE10000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download