Analysis

  • max time kernel
    63s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 01:33

General

  • Target

    97a862e9d8fe4a678ef6cfab111d13097b12f479b6ba86c6040217087b0278b9.exe

  • Size

    256KB

  • MD5

    1d012ae931c84a5dcd45b4a41b207a84

  • SHA1

    3b37ce894e526eef1ff803b5419529a357d2debe

  • SHA256

    97a862e9d8fe4a678ef6cfab111d13097b12f479b6ba86c6040217087b0278b9

  • SHA512

    ca891f6c213761cfc88054aafe18988569ac3aa3a3764102de2f6bb98906af34b54df74bf635325f1831bb852643919ad7a11d4eb344853a6069874ca55ac718

  • SSDEEP

    6144:ADLQxoyQ1LpnFyZ+dayL9rvolH8u3ZhGod:YQCyQ1LHk+zR7QHjGo

Malware Config

Signatures

  • Detects executables packed with VMProtect. 4 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 14 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\97a862e9d8fe4a678ef6cfab111d13097b12f479b6ba86c6040217087b0278b9.exe
    "C:\Users\Admin\AppData\Local\Temp\97a862e9d8fe4a678ef6cfab111d13097b12f479b6ba86c6040217087b0278b9.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2264
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
      2⤵
        PID:2972
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:808
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1976
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3980
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2456
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1904
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4380
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4420
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3440
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4272
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2868
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4580
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3148
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4920
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:812
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4852
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2356
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4524
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2640
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3444
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1008
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4816
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4620
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2704
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2116
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:892
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4836
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:1052
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3936
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3332
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3564
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1532
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:892
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:460
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1892
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4116
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4500
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3972
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3260
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3712
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2116
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:2188
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1892
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3464
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3956
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1560
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2716
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3968
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3536
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:752
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:1484
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:2456
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:2628
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4428
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4128
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3568
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4568
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3496
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:892
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3696
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:1140
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:1972
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1524
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3536
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:5016
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1732
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4276
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:4864
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:1220
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3480
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:2776
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:4908
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:3868
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:4524
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2384
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4432
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:636
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:1052
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1560
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:2176
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:3884
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3560
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4396
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:2960
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:2200
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:3888
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:2716
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:3680
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:5044
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:960
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:1608
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:3600

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                471B

                                                                                                                MD5

                                                                                                                7c8f5eeed84ecc871f84acbcdd5bd0bf

                                                                                                                SHA1

                                                                                                                11099f76796efeeedb768334b21c2357aeb729eb

                                                                                                                SHA256

                                                                                                                c92449d48523c6a16f9a59e5b825aab6a5973c55c23733045f3738cbf0b0b387

                                                                                                                SHA512

                                                                                                                5e0dddcef18267d61031db39bd07b54d26116b15f53078130bb3ad541479eefb349c7cc7ceaca0884999401867fafb716e3180d9fd727920318007488c599218

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                Filesize

                                                                                                                412B

                                                                                                                MD5

                                                                                                                73ed7a9467d1e54782171b7af8e301a6

                                                                                                                SHA1

                                                                                                                e3bf01897120fb8f8f9a3ea6fcaf3877d8746be1

                                                                                                                SHA256

                                                                                                                ec5a09428abd2ca88063165c02db0181e68f8b83f4190a13d8bf85d4c554aeb4

                                                                                                                SHA512

                                                                                                                692a7daf28a2e422b469877add01a671cf3e0939536d410169f6c07bd6d8d545ca0518369e215d53baf84fa64bffda65c724164fed12b289b37cdcb496d73622

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                23582c91977ed07c4e0dad0202208038

                                                                                                                SHA1

                                                                                                                a4dd80b8c1500c24cf74615f7372bdf2d2069de8

                                                                                                                SHA256

                                                                                                                7c7f4b0ae6d8e127ad27f9307a311a439067b8c2fded7348d5b2a2e8a0aa087e

                                                                                                                SHA512

                                                                                                                3b9b20ee2d6eb5a78c1dc9be9a50b5ba5dea3efc58d41980226dfeee00bf5cb628f5d491f6cfd31ddc2f9c861f3e00cf404bfe0711ea9fe4a9e89072ca1548a0

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133607288430518880.txt

                                                                                                                Filesize

                                                                                                                75KB

                                                                                                                MD5

                                                                                                                8cdd0e31fdc880d03dd47abc4b0efbf9

                                                                                                                SHA1

                                                                                                                37648604549b090bc8683dffda89fe8338b18d9c

                                                                                                                SHA256

                                                                                                                edf5f36d377aa149ebfbf55c896fe8716ea11f49a9ec61df2d327bc43c835bab

                                                                                                                SHA512

                                                                                                                b7cb49eb50e7b5e0d36c7e971b39bde726d36383f5723ad5bb082c266435550030d5a8b53eda5c2ddfc720d73007aba4ffd36b32949161876104328d98a9a511

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

                                                                                                                Filesize

                                                                                                                22KB

                                                                                                                MD5

                                                                                                                543e8013ccc7bdcd43a64ba8402b6fe7

                                                                                                                SHA1

                                                                                                                1c5e6f878c1522d1397aaaa2af559a98fb4210a7

                                                                                                                SHA256

                                                                                                                7a07e3fd9de623a0da759af4176a63dd233d61f587797298805312af927854ed

                                                                                                                SHA512

                                                                                                                0e47bf388305822cd98d931d1c85dff7972dbd5ab773ff9aa668152c8a555c8df980bed038211c0b873b4d6d6eccab2a7ba2772ff5175f2fcb3905a0d90ccc22

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\N2176ZEZ\microsoft.windows[1].xml

                                                                                                                Filesize

                                                                                                                97B

                                                                                                                MD5

                                                                                                                bdd90a1d11585d1f2b7720be412bc048

                                                                                                                SHA1

                                                                                                                b6245dfce68b60c708dd7ecabaebeabcbb53920f

                                                                                                                SHA256

                                                                                                                ddf2d606339b78bea2b3d3e823f4074cc7a4c8281242a81cc0c2c0332b08330e

                                                                                                                SHA512

                                                                                                                e62ea18449d0d36f50bcb3590a2c60397a8dbb7654b375facab3ee3ef6d0efb9a1cd67ba8e4af23ac1b3ca5955a9125c7b8fa2fa6781ad214f37d0ed3ef8c950

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yyyy

                                                                                                                Filesize

                                                                                                                256KB

                                                                                                                MD5

                                                                                                                87870fc5fb8af2cae9c0c3af97527a41

                                                                                                                SHA1

                                                                                                                e2ed1bf850acc813d3fa3b69869e382fcada27e5

                                                                                                                SHA256

                                                                                                                c6d0c71807939c3c5e8de09093ff7eb55138cde3f209003dfaa072686dcd172c

                                                                                                                SHA512

                                                                                                                79e0d92a381a66a80f4392c1891354450ba85e1b8ede2fdf4cef28d4105d13d243abb8042f933375db733df2cfc780d0cfe64928bf9c6c63256ea50c740e63ac

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yyyy.bat

                                                                                                                Filesize

                                                                                                                337B

                                                                                                                MD5

                                                                                                                9fe5da7e754dc4f7057d7d974f5482f3

                                                                                                                SHA1

                                                                                                                4e5a152fbd0ace9e6f8ee29dad66e100c5d64ec5

                                                                                                                SHA256

                                                                                                                6662d0cd26ea2e9d919c67226d508c951e9e141d82c7c28b7f3ef5399191549d

                                                                                                                SHA512

                                                                                                                7a0283f6646227a9062e10de996be5067aff7d8d531a11ef142af6e36c21311eff27540ea40bcda4267d9dd46757e7e0bbe3ba349d3660f6147193efcc812a52

                                                                                                              • C:\Windows\System32\drivers\etc\hosts

                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                6f332dcaeeb548cceb98beb934ab3d55

                                                                                                                SHA1

                                                                                                                e48872682e514e95dcc14ff9bbdc6e0bef723fca

                                                                                                                SHA256

                                                                                                                7937ea22b6d3b09f8d41afef1371aaee906657aafce6678b0b449931a1a8c4c0

                                                                                                                SHA512

                                                                                                                e695693e246253fa969b57c20c4147009846d7848bc092c97aa830daf2f89e0c1a1850cb0c7e5715a95ebf19cdf58726eec3a9820f0b8820e495234ce22f2844

                                                                                                              • memory/460-1401-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/892-1257-0x00000269B78C0000-0x00000269B78E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/892-1288-0x00000269B7C90000-0x00000269B7CB0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/892-1268-0x00000269B7880000-0x00000269B78A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/892-1251-0x00000261B5760000-0x00000261B5860000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/1008-658-0x0000022761C40000-0x0000022761C60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1008-647-0x0000022761C80000-0x0000022761CA0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1008-678-0x0000022762050000-0x0000022762070000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/1052-1100-0x0000000004690000-0x0000000004691000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/2116-948-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/2300-0-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                Filesize

                                                                                                                560KB

                                                                                                              • memory/2300-14-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                Filesize

                                                                                                                560KB

                                                                                                              • memory/2300-1-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                Filesize

                                                                                                                560KB

                                                                                                              • memory/2456-28-0x00000000037B0000-0x00000000037B1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/2640-639-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/2704-810-0x0000019C8B570000-0x0000019C8B590000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2704-798-0x0000019C8B5B0000-0x0000019C8B5D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2704-820-0x0000019C8B980000-0x0000019C8B9A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/2704-794-0x0000019C8A450000-0x0000019C8A550000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/2704-793-0x0000019C8A450000-0x0000019C8A550000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/2868-340-0x0000000004150000-0x0000000004151000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/3148-344-0x0000021854980000-0x0000021854A80000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/3148-348-0x00000218557E0000-0x0000021855800000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3148-378-0x00000218557A0000-0x00000218557C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3148-379-0x0000021855E30000-0x0000021855E50000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3260-1551-0x00000187B72F0000-0x00000187B7310000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3260-1564-0x00000187B72B0000-0x00000187B72D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3332-1102-0x000002ECB2F40000-0x000002ECB3040000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/3332-1107-0x000002ECB40A0000-0x000002ECB40C0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3332-1103-0x000002ECB2F40000-0x000002ECB3040000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/3332-1131-0x000002ECB4470000-0x000002ECB4490000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3332-1119-0x000002ECB4060000-0x000002ECB4080000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/3564-1249-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4116-1408-0x000001612DDE0000-0x000001612DE00000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4116-1435-0x000001612E1B0000-0x000001612E1D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4116-1420-0x000001612DDA0000-0x000001612DDC0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4272-191-0x000001DD1C900000-0x000001DD1CA00000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/4272-216-0x000001DD1DE20000-0x000001DD1DE40000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4272-190-0x000001DD1C900000-0x000001DD1CA00000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/4272-194-0x000001DD1DA60000-0x000001DD1DA80000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4272-189-0x000001DD1C900000-0x000001DD1CA00000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/4272-203-0x000001DD1DA20000-0x000001DD1DA40000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4380-31-0x000001511BA00000-0x000001511BB00000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/4380-29-0x000001511BA00000-0x000001511BB00000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/4380-34-0x000001511C900000-0x000001511C920000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4380-41-0x000001511C8C0000-0x000001511C8E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4380-65-0x000001511CEE0000-0x000001511CF00000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4420-188-0x0000000004700000-0x0000000004701000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4500-1544-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4524-492-0x000001A832820000-0x000001A832920000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/4524-493-0x000001A832820000-0x000001A832920000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                              • memory/4524-509-0x000001A833940000-0x000001A833960000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4524-521-0x000001A833D50000-0x000001A833D70000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4524-497-0x000001A833980000-0x000001A8339A0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4816-791-0x00000000029F0000-0x00000000029F1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4836-956-0x0000016018240000-0x0000016018260000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4836-969-0x0000016018200000-0x0000016018220000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4836-977-0x0000016018610000-0x0000016018630000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                              • memory/4852-491-0x0000000004370000-0x0000000004371000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB