Overview

overview

7

Static

static

3

bfddcea545...47.exe

windows7-x64

7

bfddcea545...47.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    73s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 04:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bfddcea5454a7997305696541e6d6347.exe

  • Size

    286KB

  • MD5

    bfddcea5454a7997305696541e6d6347

  • SHA1

    2885d22411b1a0f5565e0542bb38c0a3cf7a0e4d

  • SHA256

    6f6f647a9bafb8dfd42593d4d77abdd05947bc6a49716b79fbbc1a51f293079d

  • SHA512

    2a404382475c49f150a30eb283811002da5ba848988d8c139a653f72b2bdb41878b32c885c6a5dcef6e0c9e36ed98d6edd7f5c6b6efbcd4fc7f79a2bf1b6a205

  • SSDEEP

    6144:23MrONR1cNwPLvoqg0R2VhPefm0ToyugupkXHykED/m0eNGGs:o171c2obY7WDK3yh/n

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 40 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 40 IoCs
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 40 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfddcea5454a7997305696541e6d6347.exe
    "C:\Users\Admin\AppData\Local\Temp\bfddcea5454a7997305696541e6d6347.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\SysWOW64\agetlksyiey.exe
      "C:\Windows\system32\agetlksyiey.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Windows\SysWOW64\agetlksyiey.exe
        "C:\Windows\system32\agetlksyiey.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1104
        • C:\Windows\SysWOW64\agetlksyiey.exe
          "C:\Windows\system32\agetlksyiey.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4888
          • C:\Windows\SysWOW64\agetlksyiey.exe
            "C:\Windows\system32\agetlksyiey.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3232
            • C:\Windows\SysWOW64\agetlksyiey.exe
              "C:\Windows\system32\agetlksyiey.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4312
              • C:\Windows\SysWOW64\agetlksyiey.exe
                "C:\Windows\system32\agetlksyiey.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1552
                • C:\Windows\SysWOW64\agetlksyiey.exe
                  "C:\Windows\system32\agetlksyiey.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1544
                  • C:\Windows\SysWOW64\agetlksyiey.exe
                    "C:\Windows\system32\agetlksyiey.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2668
                    • C:\Windows\SysWOW64\agetlksyiey.exe
                      "C:\Windows\system32\agetlksyiey.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2916
                      • C:\Windows\SysWOW64\agetlksyiey.exe
                        "C:\Windows\system32\agetlksyiey.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1744
                        • C:\Windows\SysWOW64\agetlksyiey.exe
                          "C:\Windows\system32\agetlksyiey.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3624
                          • C:\Windows\SysWOW64\agetlksyiey.exe
                            "C:\Windows\system32\agetlksyiey.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2996
                            • C:\Windows\SysWOW64\agetlksyiey.exe
                              "C:\Windows\system32\agetlksyiey.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:760
                              • C:\Windows\SysWOW64\agetlksyiey.exe
                                "C:\Windows\system32\agetlksyiey.exe"
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1668
                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                  "C:\Windows\system32\agetlksyiey.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3152
                                  • C:\Windows\SysWOW64\agetlksyiey.exe
                                    "C:\Windows\system32\agetlksyiey.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:4620
                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                      "C:\Windows\system32\agetlksyiey.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:3544
                                      • C:\Windows\SysWOW64\agetlksyiey.exe
                                        "C:\Windows\system32\agetlksyiey.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:4996
                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                          "C:\Windows\system32\agetlksyiey.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:1540
                                          • C:\Windows\SysWOW64\agetlksyiey.exe
                                            "C:\Windows\system32\agetlksyiey.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:5068
                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                              "C:\Windows\system32\agetlksyiey.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:2916
                                              • C:\Windows\SysWOW64\agetlksyiey.exe
                                                "C:\Windows\system32\agetlksyiey.exe"
                                                23⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4460
                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4988
                                                  • C:\Windows\SysWOW64\agetlksyiey.exe
                                                    "C:\Windows\system32\agetlksyiey.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1968
                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4596
                                                      • C:\Windows\SysWOW64\agetlksyiey.exe
                                                        "C:\Windows\system32\agetlksyiey.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2224
                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3168
                                                          • C:\Windows\SysWOW64\agetlksyiey.exe
                                                            "C:\Windows\system32\agetlksyiey.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3644
                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • Modifies registry class
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1968
                                                              • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                "C:\Windows\system32\agetlksyiey.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1448
                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • Modifies registry class
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2184
                                                                  • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                    "C:\Windows\system32\agetlksyiey.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • Modifies registry class
                                                                    PID:2532
                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • Modifies registry class
                                                                      PID:4056
                                                                      • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                        "C:\Windows\system32\agetlksyiey.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Modifies registry class
                                                                        PID:2984
                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          • Modifies registry class
                                                                          PID:4528
                                                                          • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                            "C:\Windows\system32\agetlksyiey.exe"
                                                                            37⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • Modifies registry class
                                                                            PID:3820
                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Modifies registry class
                                                                              PID:964
                                                                              • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                "C:\Windows\system32\agetlksyiey.exe"
                                                                                39⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                • Modifies registry class
                                                                                PID:4056
                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies registry class
                                                                                  PID:1616
                                                                                  • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                    "C:\Windows\system32\agetlksyiey.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    PID:1644
                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                      42⤵
                                                                                        PID:4764
                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                          43⤵
                                                                                            PID:2768
                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                              44⤵
                                                                                                PID:2984
                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                  45⤵
                                                                                                    PID:1448
                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                      46⤵
                                                                                                        PID:4832
                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                          47⤵
                                                                                                            PID:3484
                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                              48⤵
                                                                                                                PID:4608
                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                  49⤵
                                                                                                                    PID:3820
                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                      50⤵
                                                                                                                        PID:4124
                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                          51⤵
                                                                                                                            PID:3152
                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                              52⤵
                                                                                                                                PID:4068
                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                  53⤵
                                                                                                                                    PID:948
                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                      54⤵
                                                                                                                                        PID:4608
                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                          55⤵
                                                                                                                                            PID:1888
                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                              56⤵
                                                                                                                                                PID:1548
                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                  57⤵
                                                                                                                                                    PID:3304
                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                      58⤵
                                                                                                                                                        PID:1668
                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                          59⤵
                                                                                                                                                            PID:3644
                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                              60⤵
                                                                                                                                                                PID:4620
                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                  61⤵
                                                                                                                                                                    PID:3720
                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                      62⤵
                                                                                                                                                                        PID:4104
                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                          63⤵
                                                                                                                                                                            PID:3528
                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                              64⤵
                                                                                                                                                                                PID:2768
                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                  65⤵
                                                                                                                                                                                    PID:3884
                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                      66⤵
                                                                                                                                                                                        PID:3628
                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                          67⤵
                                                                                                                                                                                            PID:1320
                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                              68⤵
                                                                                                                                                                                                PID:4692
                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                    PID:3192
                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                PID:468
                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                        PID:2016
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                            PID:528
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                              76⤵
                                                                                                                                                                                                                                PID:4028
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                    PID:3616
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                        PID:3820
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                            PID:2116
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                                                                            PID:3720
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                    PID:1588
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                        PID:764
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                    PID:436
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                        PID:1588
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                            PID:4580
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                PID:464
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                    PID:3624
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                        PID:2208
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                            PID:4404
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                PID:4644
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                    PID:2168
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                                                                                                            PID:4872
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                    PID:3436
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                                                        PID:1616
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                                                            PID:860
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                                                                                                                                        PID:184
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4872
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3556
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2768
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1548
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:220
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\agetlksyiey.exe"
                                                                                                                                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2380
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2364

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\Windows\SysWOW64\agetlksyiey.exe
                                                                                                                                                        Filesize

                                                                                                                                                        286KB

                                                                                                                                                        MD5

                                                                                                                                                        bfddcea5454a7997305696541e6d6347

                                                                                                                                                        SHA1

                                                                                                                                                        2885d22411b1a0f5565e0542bb38c0a3cf7a0e4d

                                                                                                                                                        SHA256

                                                                                                                                                        6f6f647a9bafb8dfd42593d4d77abdd05947bc6a49716b79fbbc1a51f293079d

                                                                                                                                                        SHA512

                                                                                                                                                        2a404382475c49f150a30eb283811002da5ba848988d8c139a653f72b2bdb41878b32c885c6a5dcef6e0c9e36ed98d6edd7f5c6b6efbcd4fc7f79a2bf1b6a205

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Windows\SysWOW64\psapi.lib
                                                                                                                                                        Filesize

                                                                                                                                                        19KB

                                                                                                                                                        MD5

                                                                                                                                                        a5b1b1f7c2c51ff400d93ae63f484d96

                                                                                                                                                        SHA1

                                                                                                                                                        5f038003bf8851254ba577db5d8dfd69c1085c33

                                                                                                                                                        SHA256

                                                                                                                                                        35b1d2d2bc5c531d49aa3550de5c19bd5f4ebe79c594c6f5000d6de28b2621bf

                                                                                                                                                        SHA512

                                                                                                                                                        90c2145b39611bd1406c513dff16366a51e86e8831c34ab15f650e6620a75533e800db056dda2e7e176fac8b20cd0be76bc1725b45930b31595d4aac00da4eec

                                                                                                                                                        Download Submit

                                                                                                                                                      • memory/760-475-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/948-1674-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/964-1246-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1104-206-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1448-1525-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1448-920-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1536-197-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1540-640-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1544-291-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1548-1740-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1552-281-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1616-1338-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1644-1404-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1668-1790-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1668-486-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1744-358-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1888-1686-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1968-838-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1968-912-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2184-973-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2224-854-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-59-0x0000000002510000-0x0000000002511000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-16-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-22-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-23-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-24-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-25-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-26-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-27-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-28-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-29-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-30-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-31-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-32-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-33-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-34-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-35-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-36-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-37-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-38-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-53-0x0000000002530000-0x0000000002531000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-52-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-54-0x00000000024C0000-0x00000000024C1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-51-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-50-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-49-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-48-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-47-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-46-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-55-0x00000000024B0000-0x00000000024B1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-45-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-44-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-43-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-42-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-41-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-40-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-39-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-56-0x00000000024F0000-0x00000000024F1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-57-0x0000000002500000-0x0000000002501000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-58-0x0000000002550000-0x0000000002551000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-60-0x00000000024D0000-0x00000000024D1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-20-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-61-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-62-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-63-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-64-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-128-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-195-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-0-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-1-0x00000000022B0000-0x0000000002300000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        320KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-19-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-18-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-2-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-17-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-4-0x0000000002410000-0x0000000002411000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-21-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-3-0x0000000002480000-0x0000000002481000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-5-0x0000000002400000-0x0000000002401000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-15-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-14-0x0000000002430000-0x0000000002431000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-7-0x0000000002450000-0x0000000002451000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-6-0x0000000002440000-0x0000000002441000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-8-0x0000000002490000-0x0000000002491000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-9-0x0000000002460000-0x0000000002461000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-10-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-12-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-11-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2340-13-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2532-1017-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2668-340-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2768-1471-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2916-743-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2916-352-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2984-1074-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2984-1481-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2996-413-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3152-1610-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3152-537-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3168-897-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3232-265-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3304-1783-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3484-1578-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3544-599-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3624-405-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3644-907-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3644-1840-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3720-1914-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3820-1167-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3820-1599-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4056-1067-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4056-1292-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4068-1666-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4104-1920-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4124-1605-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4312-274-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4460-752-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4528-1081-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4596-846-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4608-1679-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4608-1593-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4620-588-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4620-1902-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4764-1412-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4832-1531-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4888-256-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4988-792-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4996-632-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5068-694-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        352KB

                                                                                                                                                        Download