Analysis

  • max time kernel
    65s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2024, 07:33

General

  • Target

    Bedwarmer.ps1

  • Size

    58KB

  • MD5

    aae5fcb1e66470ef7a08ea335b80ac05

  • SHA1

    9422c0898c87a134c72c6ffa35c594d93dba9dc9

  • SHA256

    8bd9205c7c8f112ff5cba1307842eddccc18e20e227cccb7b74e6a24e686b8b0

  • SHA512

    031d187a47a9b687d6822f34e74029f2f1cf4eb8687dc2846a3d84efbf9d30d5459870842a22cdab89130915501e2593f79b2a32da5c266d382120e0a042b072

  • SSDEEP

    1536:kIA6tvaB6ot7AWRT/HFQzHYDLaKzxxkRq:kIltiBhzlQELaKzjD

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 14 IoCs
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Bedwarmer.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:216
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3996
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1496
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2760
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3588
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4440
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:1324
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4408
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:868
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:5032
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3356
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4664
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:2280
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4408
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3456
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:228
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4264
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2996
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:676
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4180
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3788
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:224
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4772
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:384
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3836
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3128
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1692
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4676
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4436
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3672
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3888
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4144
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:976
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:1328
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2704
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4180
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2220
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4272
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      PID:852
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:5024
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2344
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4964
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:368
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:2532
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2180
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3712
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4352
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3476
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:752
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:216
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4748
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:1088
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:460
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4276
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:2920
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:4468
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3084
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:5048
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4596
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3488
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3764
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:3836
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3572
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:1528
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4224
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1192
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3448
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3592
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3172
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3796
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3068
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:400
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3892
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:944
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:1816
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:1692
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1708
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:2740
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3400
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:2620
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:3712
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3008
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4944
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3296
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3752
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:3316
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3576
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:1816
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:2472

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                          Filesize

                                                                                                          471B

                                                                                                          MD5

                                                                                                          6475b19cdf10d6f0ccf27ebf0fe76309

                                                                                                          SHA1

                                                                                                          6c3ca7a137c2b3041cdb22c994bba356e33f93c4

                                                                                                          SHA256

                                                                                                          635f833910db4e0915ecfe0d515341d4feec384dd83d6309f71f336c838a75d1

                                                                                                          SHA512

                                                                                                          9f695eae05fd9bc6f775cd2e8ec1a235976d82bf8b206449b0595e97afd335b31e79706b281b920e08de6d90a05a7e8b777f6d15bdbf815e61bf96e19542f4ce

                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                          Filesize

                                                                                                          412B

                                                                                                          MD5

                                                                                                          30209662b641b27b53127229f4ef4195

                                                                                                          SHA1

                                                                                                          b7b21a74c7a9673fad31972f1d1ef51d2a271b7f

                                                                                                          SHA256

                                                                                                          7c8db80de878fcd0d0fc7e66783f214589b75e316d2938c509c4bb4813f10295

                                                                                                          SHA512

                                                                                                          c46d7c0e28771634dee6a08a04127f50429769acbef45d5801c96763c483991de965df72e56d3cd4ea3d5ad12be1396bf6d5ca290ae376bcb743bec3685bded2

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          14e664adbf5e5fc29dc1d5dba7040d56

                                                                                                          SHA1

                                                                                                          8423af2029fb634cf57f8634d0925638d3bbb557

                                                                                                          SHA256

                                                                                                          f850e623c80e0ace7cc1751317d06e289903818b7e4bee8625df151d4066126f

                                                                                                          SHA512

                                                                                                          9be6b7dc4dfb65102485911ca412daaaae46da9f9919836585bec066cebdba9b3f59b51b5a0b7695d7fe5cf5bdaf24bde466b62a2afb859edd46509e683a9730

                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QDDM1QX5\microsoft.windows[1].xml

                                                                                                          Filesize

                                                                                                          96B

                                                                                                          MD5

                                                                                                          2415f1b0b1e5150e9f1e871081fd1fad

                                                                                                          SHA1

                                                                                                          a79e4bfddc3daf75f059fda3547bd18282d993f7

                                                                                                          SHA256

                                                                                                          3eff25035403aba506d0dbf69c76a22fa90ec66d2094cbf39bc5267a850902ae

                                                                                                          SHA512

                                                                                                          5d05da9ec1471dbf91f0c474c8db3897130543ff3c4da70724ce3a36adc38f628264c3dae4f54caef493f7593a0986a944dda0e19e947f3dfc34fc16fbd3e6bb

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xtdb0cjy.exl.ps1

                                                                                                          Filesize

                                                                                                          60B

                                                                                                          MD5

                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                          SHA1

                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                          SHA256

                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                          SHA512

                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                        • memory/216-352-0x000001EF8A960000-0x000001EF8A980000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/216-350-0x000001EF8A550000-0x000001EF8A570000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/216-348-0x000001EF8A590000-0x000001EF8A5B0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/224-159-0x00000000022E0000-0x00000000022E1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/228-113-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/384-167-0x0000018E295B0000-0x0000018E295D0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/384-171-0x0000018E29980000-0x0000018E299A0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/384-169-0x0000018E29570000-0x0000018E29590000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/460-368-0x00000241CB240000-0x00000241CB260000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/460-370-0x00000241CB200000-0x00000241CB220000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/460-372-0x00000241CB600000-0x00000241CB620000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/676-133-0x0000000004690000-0x0000000004691000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/852-274-0x0000000004860000-0x0000000004861000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/868-59-0x0000020DD2720000-0x0000020DD2740000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/868-57-0x0000020DD2760000-0x0000020DD2780000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/868-61-0x0000020DD2B20000-0x0000020DD2B40000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/976-235-0x0000023221140000-0x0000023221160000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/976-239-0x0000023221510000-0x0000023221530000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/976-237-0x0000023221100000-0x0000023221120000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1324-49-0x0000000004110000-0x0000000004111000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/1328-250-0x0000000004910000-0x0000000004911000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/1620-13-0x0000027AED380000-0x0000027AED390000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1620-16-0x0000027AEE380000-0x0000027AEE384000-memory.dmp

                                                                                                          Filesize

                                                                                                          16KB

                                                                                                        • memory/1620-15-0x0000027AED380000-0x0000027AED390000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1620-12-0x0000027AED380000-0x0000027AED390000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1620-11-0x0000027AED380000-0x0000027AED390000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/1620-10-0x00007FFEC48E0000-0x00007FFEC53A1000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/1620-5-0x0000027AEE1F0000-0x0000027AEE212000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/1620-17-0x00007FFEC48E0000-0x00007FFEC53A1000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/1692-193-0x0000021DDA1A0000-0x0000021DDA1C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1692-191-0x0000021DD9D90000-0x0000021DD9DB0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/1692-189-0x0000021DD9DD0000-0x0000021DD9DF0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2180-320-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2280-93-0x00000000047A0000-0x00000000047A1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2344-282-0x0000020A5D560000-0x0000020A5D580000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2344-285-0x0000020A5D920000-0x0000020A5D940000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2344-284-0x0000020A5D520000-0x0000020A5D540000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2532-305-0x000001D113440000-0x000001D113460000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2532-309-0x000001D113810000-0x000001D113830000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2532-307-0x000001D113400000-0x000001D113420000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2760-26-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/2996-125-0x0000020180970000-0x0000020180990000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2996-123-0x0000020180560000-0x0000020180580000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/2996-121-0x00000201805A0000-0x00000201805C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3456-101-0x000001AE1D320000-0x000001AE1D340000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3456-105-0x000001AE1D6E0000-0x000001AE1D700000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3456-103-0x000001AE1CFD0000-0x000001AE1CFF0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3476-340-0x0000000003E80000-0x0000000003E81000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/3672-215-0x00000217C2490000-0x00000217C24B0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3672-212-0x00000217C20C0000-0x00000217C20E0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3672-214-0x00000217C2080000-0x00000217C20A0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3788-145-0x0000028988DB0000-0x0000028988DD0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3788-143-0x00000289887A0000-0x00000289887C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3788-141-0x00000289887E0000-0x0000028988800000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/3836-182-0x0000000004260000-0x0000000004261000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/3888-228-0x0000000002920000-0x0000000002921000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4180-262-0x00000204FEB60000-0x00000204FEB80000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4180-260-0x00000204FE750000-0x00000204FE770000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4180-258-0x00000204FE790000-0x00000204FE7B0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4352-332-0x000001AECB810000-0x000001AECB830000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4352-328-0x000001AECB440000-0x000001AECB460000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4352-330-0x000001AECB400000-0x000001AECB420000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4440-37-0x0000026BA12C0000-0x0000026BA12E0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4440-34-0x0000026BA0EB0000-0x0000026BA0ED0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4440-32-0x0000026BA0EF0000-0x0000026BA0F10000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4664-83-0x00000213D11C0000-0x00000213D11E0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4664-80-0x00000213D0BB0000-0x00000213D0BD0000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4664-78-0x00000213D0E00000-0x00000213D0E20000-memory.dmp

                                                                                                          Filesize

                                                                                                          128KB

                                                                                                        • memory/4676-204-0x0000000004140000-0x0000000004141000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4748-360-0x0000000003280000-0x0000000003281000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4964-298-0x0000000003710000-0x0000000003711000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/5032-70-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB